NTFS boot sector

NTFS filesystem can become corrupt/unusable because of various reasons. In such situation windows file manager might not detect this partition.  One such situation I encountered was during formatting my laptop from Windows to Linux to Windows. The non-bootable partition of my laptop was rendered unusable.

Before going into the solution, one important property of NTFS. NTFS maintains an extra copy of the boot sector.  This extra copy eventually helped me to recover my data.

One of the first tool to use is windows utility ‘chkdsk’. On running windows utility chkdsk, it pointed to the problem ‘NTFS boot sector unreadable’.  Using ‘chkdsk \F’  didn’t fix the problem. After some googling I came across a rather very simple tool – TestDisk.  Its an opensource software with GNU General Public License.  TestDisk copied the spare boot sector record to the primary boot sector and after a restart my hard disk partition was detected successfully and my data intact.  Using TestDisk is simple and well documented on the website.

Wireshark shows network packet larger than MTU

While working on my thesis I came across a weird problem, wireshark was showing packet size more than the MTU. One of the possible reason can be underlying network supports jumbo frames. But it wasn’t so in my case. 

After some googling I found the cause, Large segmentation offload (LSO) performed by NIC. LSO technique  increases the outbound throughput of high-bandwidth networks by offloading packet processing time from CPU to Network Interface Tag (NIC). When LSO is applied to TCP, it is called TCP Segmentation Offload (TSO). When LSO is applied on TCP, it is called as TCP Segmentation Offload (TSO).

The working of TSO can be explained with the help of an example. Let a unit of 65,536 bytes is to be transmitted by the host device. Assuming MTU of 1500 bytes, this data will be divided into 46 segments of 1448 bytes each before it is transmitted over to network through the NIC. Process of dividing the data into segments before sending it over the network is handed over to NIC instead of CPU. NIC will break down the data into smaller segments, and add corresponding TCP, IP and data link layer protocol headers. This significantly reduces the work done by the CPU. Large Receive Offload (LRO) is a similar technique to LSO, but applied for incoming traffic. 

ethtool -k <interface> shows the status of  LSO and LRO.  

ethtool -K <interface> tso off and ethtool -K <interface> gso off  turns off the segmentation offload and now you can see packet size of <= MTU in wireshark.