Having traffic loss issues alongside these log messages :
14:12:05.112482 In IP truncated-ip - 32 bytes missing! [|ip]
14:12:05.112590 Out IP truncated-ip - 74 bytes missing! [|ip]
14:12:05.156821 In IP truncated-ip - 212 bytes missing! [|ip]
14:12:05.157312 Out IP truncated-ip - 245 bytes missing! [|ip]
14:12:05.245403 In IP truncated-ip - 32 bytes missing! [|ip]
14:12:05.245511 Out IP truncated-ip - 74 bytes missing! [|ip]
14:12:05.287513 In IP truncated-ip - 212 bytes missing! [|ip]
14:12:05.287956 Out IP truncated-ip - 248 bytes missing! [|ip]
14:12:05.331823 In IP truncated-ip - 32 bytes missing! [|ip]
14:12:05.331914 Out IP truncated-ip - 74 bytes missing! [|ip]
14:12:05.375920 In IP truncated-ip - 212 bytes missing! [|ip]
Also on packet capture "Bogus" is shown on the IPV4 header
_______________________________________________________________________________
"Bogus" is a flag or annotation used by protocol analyzers like Wireshark and tcpdump to indicate that a field within a packet header or payload contains an invalid, impossible, or inconsistent value.
It does not indicate that the packet itself is “fake”, but rather that the protocol dissection failed because the data did not conform to the expected standard such as an IP total length smaller than the header length.
In our capture image we can see a critical error in the Internet Protocol Version 4 (IPv4) header:
Error: Bogus IPv4 version (0, must be 4)
The first 4 bits of an IP packet header are reserved for the version number. For IPv4, this value must be 4 (binary 0100). In this trace, that value is 0 (binary 0000).
Since the version is 0, the operating system or network device cannot process the packet. It doesn't know how to read the rest of the header because the (the version) is invalid.
filter ip.bogus_ip_version
https://www.wireshark.org/docs/dfref/i/ip.html
-Juniper Logs (truncated-ip): The switch reported multiple instances of truncated-ip - [X] bytes missing!. This indicates that the physical data received by the switch was shorter than what the IP header claimed the packet size should be.
These logs indicate that the capture tool is seeing traffic but cannot display the full packet headers or payloads because the data is being cut off.
Specifically, the truncated-ip - [X] bytes missing! error is a diagnostic message about the capture process itself, not necessarily a failure of the network hardware.
truncated-ip: This means the IP header itself is incomplete, or the packet is shorter than the length specified in the IP header's "Total Length" field.
[X] bytes missing!: This is the difference between what the packet claims its size is and what the capture tool actually received.
[|ip]: This is the standard tcpdump notation indicating that it stopped parsing the packet because the data ended prematurely.
When a phone or other hardware sends a packet traversing devices with mismatch MTU, the devices might be forced to drop the "tail" of the packet, this could result in:
Malformed packets that Wireshark cannot decode (hence the "Version 0" error).
Incomplete data reaching the application, causing traffic quality issues.
There was a discrepancy between the Juniper switch and another network device MTU
The MTU settings have been adjusted to match between the 2 network devices
Initial test indicates that traffic stability has improved since the change was implemented.
No more reports of Bogus packets or missing bytes were received