--- title: ArubaCX Cannot Count When Dealing with VXLAN «... description: ArubaCX virtual machines generate VXLAN-encapsulated packets with invalid IP and UDP length fields — the packet claims to contain four more bytes than it... canonical: https://daily.dev/posts/arubacx-cannot-count-when-dealing-with-vxlan-ipspace-net-blog-qkr9iwtxy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ArubaCX Cannot Count When Dealing with VXLAN « ipSpace.net blog | daily.dev og:description: ArubaCX virtual machines generate VXLAN-encapsulated packets with invalid IP and UDP length fields — the packet claims to contain four more bytes than it... og:url: https://daily.dev/posts/arubacx-cannot-count-when-dealing-with-vxlan-ipspace-net-blog-qkr9iwtxy og:image: https://api.daily.dev/og/posts/Qkr9iwTXY.png og:image:alt: ArubaCX Cannot Count When Dealing with VXLAN « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ArubaCX Cannot Count When Dealing with VXLAN « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 4 min read · 0 upvotes · 0 comments ## Summary ArubaCX virtual machines generate VXLAN-encapsulated packets with invalid IP and UDP length fields — the packet claims to contain four more bytes than it actually does. The root cause is that the VLAN tag is stripped before software VXLAN encapsulation but the packet length field is never adjusted. This bug causes intermittent test failures depending on whether adjacent devices verify IP packet length: Arista vEOS (connected via libvirt UDP tunnel, bypassing the Linux bridge) accepts the malformed packets, while FRR containers and Arista cEOS (connected through a Linux bridge) drop them. The Linux bridge behavior is further complicated by a firewall kernel module that loads dynamically and silently drops packets with invalid IP lengths, explaining why tests pass after a server reboot but fail later. The post also notes that most VXLAN implementations skip IP/UDP length validation, which is why the bug is not universally fatal. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why do ArubaCX VXLAN packets have incorrect IP or UDP length fields? ArubaCX's software routing process attaches a VLAN tag to a packet before VXLAN encapsulation, then strips the tag — but fails to adjust the IP and UDP length fields. The result is a VXLAN-encapsulated packet that claims to be four bytes larger than the actual Ethernet frame, which causes drops on devices or Linux bridges that validate IP packet length. _Engineers debugging ArubaCX VXLAN interoperability issues track findings like this on daily.dev._ ### Why does a Linux bridge sometimes drop VXLAN packets with invalid IP length? A Linux bridge can act as a firewall when a specific kernel module is loaded dynamically after boot. That module validates IP packet length and silently drops packets where the declared length exceeds the actual frame size. Because the module is not loaded at boot time, tests pass after a server reboot but fail once something triggers the module to load. _Networking engineers chasing intermittent Linux bridge packet drops find relevant troubleshooting threads on daily.dev._ ## Similar posts on daily.dev - [The Never-Ending IPv6 Loopback Prefix Saga « ipSpace.net blog](https://daily.dev/posts/the-never-ending-ipv6-loopback-prefix-saga-ipspace-net-blog-4nlhgh10l) · ipSpace.net Blog · 0 upvotes · 0 comments - [Arista cEOS Does Not Apply ACLs to Control-Plane Traffic « ipSpace.net blog](https://daily.dev/posts/arista-ceos-does-not-apply-acls-to-control-plane-traffic-ipspace-net-blog-ieh2uzhm7) · ipSpace.net Blog · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/arubacx-cannot-count-when-dealing-with-vxlan-ipspace-net-blog-qkr9iwtxy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ArubaCX Cannot Count When Dealing with VXLAN « ipSpace.net blog","url":"https://daily.dev/posts/arubacx-cannot-count-when-dealing-with-vxlan-ipspace-net-blog-qkr9iwtxy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/arubacx-cannot-count-when-dealing-with-vxlan-ipspace-net-blog-qkr9iwtxy"},"datePublished":"2026-08-11T08:52:05.627Z","dateModified":"2026-08-24T07:05:00.536Z","description":"ArubaCX virtual machines generate VXLAN-encapsulated packets with invalid IP and UDP length fields — the packet claims to contain four more bytes than it...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e666ffbbdbc23b34008823a9cba342a5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e666ffbbdbc23b34008823a9cba342a5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/arubacx-cannot-count-when-dealing-with-vxlan-ipspace-net-blog-qkr9iwtxy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"ArubaCX Cannot Count When Dealing with VXLAN « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/arubacx-cannot-count-when-dealing-with-vxlan-ipspace-net-blog-qkr9iwtxy#faq","mainEntity":[{"@type":"Question","name":"Why do ArubaCX VXLAN packets have incorrect IP or UDP length fields?","acceptedAnswer":{"@type":"Answer","text":"ArubaCX's software routing process attaches a VLAN tag to a packet before VXLAN encapsulation, then strips the tag — but fails to adjust the IP and UDP length fields. The result is a VXLAN-encapsulated packet that claims to be four bytes larger than the actual Ethernet frame, which causes drops on devices or Linux bridges that validate IP packet length. Engineers debugging ArubaCX VXLAN interoperability issues track findings like this on daily.dev."}},{"@type":"Question","name":"Why does a Linux bridge sometimes drop VXLAN packets with invalid IP length?","acceptedAnswer":{"@type":"Answer","text":"A Linux bridge can act as a firewall when a specific kernel module is loaded dynamically after boot. That module validates IP packet length and silently drops packets where the declared length exceeds the actual frame size. Because the module is not loaded at boot time, tests pass after a server reboot but fail once something triggers the module to load. Networking engineers chasing intermittent Linux bridge packet drops find relevant troubleshooting threads on daily.dev."}}]} ```