Hi, I suspect that the virtio network driver calls some skb BPF programs with skb->data_end - skb->data != skb->len, but only for forwarded packets. For instance, the attached sched_cls tc program prints skb->data, skb->data_end and skb->len for each packet: <idle>-0 [000] ..s. 491.561727: 0: data: 3110080576 data_end: 3110080704 len: 262 <idle>-0 [000] .Ns. 491.561752: 0: data: 3110080064 data_end: 3110080192 len: 250 As it can be seen, the frame length should be 262 and 250 bytes, but data_end - data is always 128. For packets smaller than 128 it works fine. I've tried the latest kernel (5.3-rc1) besides 4.14, 4.19, 5.2, etc., and the error persists. Other drivers than virtio work as expected and I can inspect every byte of the packet. Locally generated traffic also works as expected. To carry out this experiment I've used a Debian 10 virtual machine with net.ipv4.ip_forward=1 and net.ipv4.conf.eth0.forwarding=1, forwarding packets between its two virtio interfaces. The example program is run with the following command, having BCC installed: $> sudo python3 pkt_len_text.py eth0 Where "eth0" could be another ingress interface. The output is showed at /sys/kernel/debug/tracing/trace_pipe. Can anyone confirm if this error is reproducible, and does it have any solutions? BR. Arnau -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.linuxfoundation.org/pipermail/virtualization/attachments/20190724/aa45df6a/attachment.html> -------------- next part -------------- A non-text attachment was scrubbed... Name: pkt_len_test.py Type: text/x-python Size: 1133 bytes Desc: not available URL: <http://lists.linuxfoundation.org/pipermail/virtualization/attachments/20190724/aa45df6a/attachment.py>