Questions and Answers

Jim McKinstry and Amy Rich

Q: I have a Linux machine that logged the following error message. Do you know what it's from or what it means?

kernel: Suspect short first fragment.
kernel: eth0 PROTO=17 OUTSIDE_IP:0 MY_IP:0 L=24 S=0x00 I=57374 F=0x2000 T=116 (#0)

A: This is your kernel intercepting a packet that is too short to be valid. IP packets that are too large can be split into multiple packets, and each part is called a fragment. The kernel then reassembles all of the fragments to get a full packet. This kernel message indicates that someone (probably maliciously) sent you a packet that was too short even to contain the headers for the fragment. Short fragments are usually signs of an attack on your machine.

Q: I was running FreeBSD 4.2-STABLE on a second partition on my laptop, when the need arose to install Windows. I put Windows 98 on the primary partition, and, unfortunately, this overwrote the MBR, and I can no longer boot into my FreeBSD partition. Can I recover my data? Do I need to reinstall?

A: You can easily recover your information, and even be able to boot off the secondary partition as long as your Windows install didn't overwrite the partition your FreeBSD install resides on. You can download the bootinst.exe DOS program from: ftp://ftp.FreeBSD.org/pub/FreeBSD/releases/i386/4.2-RELEASE/tools/ and redo the MBR from DOS.

You can also use boot0cfg from FreeBSD. Insert your FreeBSD boot disk, and press a key when the machine starts to boot. If you don't have a boot disk, the images can be obtained from: