[lwip-users] Bug reading TCP-Socket via netconn_recv()

[Ali Naseri]

Hello,

I am using LWIP in a project for the implementation of a ModbusTCP interface.

From the LWIP stack the sequential netconn API is used in a RTOS, KEIL RTX4.

The PHY is connected via netIF, the SYS-ARCH has been implemented. Every 10ms there is a forced TASK SWITCH.

The microcontroller is a LPC1788 with 100MHz clock and 96Kbyte RAM.

I did an analysis of the network traffic with Wireshark and found a very sporadic error: When reading from the TCP socket via netconn_recv() a pointer is returned via netbuf_data(), which is offset by the packet length.

If a ModbusTCP poll packet with 12 byte length is received, then the pointer points to the end of the packet offset by 12 bytes.

This happens in a corporate network environment with high network traffic.

It looks like the ModbusTCP poll packet was stored at a location where a multicast UDP packet from a server was previously stored and overwrote it at the same start address.

So the TCP socket does not read the ModbusTCP poll packet, but the rest of the multicast UDP packet from the server, offset by 12 from the beginning of the UDP packet.

_________________________________________________________________________________
|ModbusTCP-Poll-Packet      |  UDP-Multicast-Packet from server                                                             |
|12 Bytes payload_ _______|_40 Bytes payload, first 12 Bytes overwritten by ModbusTCP-Packet_|
^                                                 ^
|                                                 |

Correct Pointer                        returned Pointer if sporadic error occurs