NRF9160 - BSD lib crash - UDP recv() - potential security issue

[emh203]

I am using nrfconnect 1.5.1 (zephyr/command line)  with modem firmware 1.2.3 and believe I have found a fairly serious bug/behavior in the UDP API.    It is pretty easy "crash" the NRF9160 with small amounts of UDP data.

Details:

In my Application, I am sending a small 100 byte UDP packet once a minute.   The server on the receiving end responds with two UDP messages sent back to back (40 bytes followed by 96 bytes).           I use a standard open/connect/send/recv pattern.   They key piece of information is that I am using recv() in a non-blocking fashion.   

recv(client_fd, (uint8_t *)&RcvBuf[0], sizeof(RcvBuf), MSG_DONTWAIT)

I periodically call recv() and check to see if data is returned.   The UDP  recv() gets called in a zephyr delayed work queue handler. I would notice that after a day or two,    system work queue thread would crash/exit but the shell thread would be active.     What I found was that if I UDP data is received faster than the poll rate of my recv() function,   bsd lib would hang.        

To trigger the issue more quickly,  I would have the server return QTY (50)   96 byte messages when it recieves a report from NRF9160.   If I disable the recv() call in my logic,   the NRF9160 will crash quickly.   It appears that if data is not read from from a socket,  the bsd_lib will simply crash.   I think the proper behavior is for bsd_lib to drop unread packets if its internal buffers are full.   Calling recv() more quickly (every 10mS)  helps but doesn't solve the issue.   

CONFIG_NRF_MODEM_LIB_HEAP_SIZE=2048

CONFIG_NRF_MODEM_LIB_SHMEM_RX_SIZE= 16384

"Crash":

In my application, all of the logic is processing on the zephyr system work queue thread.   I also have a shell configured.    I am using the term "crash" to indicate that the system work queue thread appears to exit/terminate.     When I trigger the condition,    I notice that my logic messages cease from my logic.   However,  the shell is still active.    I attempted to use a debugger but I could not find any information about the state of the worker queue thread.   It simple behaves like the work queue thread has exited.

 

To recreate:

Simply open a socket for UDP datagrams and never read the socket.    Send data to the socket/port and the NRF9160 will eventually freeze.     Note that I always run the shell and the its thread will keep running.     It also seems like the main thread exits.  I have tried to attach a debugger and cannot detect where the bsd_lib hangs.    

I do believe this is all on the receive side.   If I disable messages being sent back from my server,  I never see an issue.

I am also going to run a test where I send UDP data to unbound sockets.  I hope this doesn't cause issues as the NRF9160 would be security risk on a public IP network.  There is a potential for lots of unsolicited UDP frames.

Questions:

• Are there known issues with UDP on the NRF9160 bsd_lib?
• Has the bsd_lib been fuzz tested for UDP traffic? I am concerned that a small amount of unread packets can bring down the system.

• Can you look into the bsd_lib/modem_lib as to the behavior with unread packets?
• Is the source for nrfxlib/nrf_modem available?    It looks like this is where the issue may lie.

 

[Didrik Rokhaug]

Hi,

If you do not read the data sent from the modem to the application, you will eventually fill up the shared memory buffer, which will prevent other messages from being queued.

You should therefore always make sure that you read all data sent from the modem to the application.

This behavior is explained in the documentation: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrfxlib/nrf_modem/doc/architecture.html#rx-area

Best regards,

Didrik

[emh203]

Hello Didrik:

I understand this.    In my description,  I completely disabled reads to trigger the issue quicker.    In my normal application,  I do keep reading but there is a transient error that locks up the modem library completely.      

After some more experimentation,  I actually found that if 

CONFIG_NRF_MODEM_LIB_HEAP_SIZE=512 (default)

I can trigger the bug.

If I change to:

CONFIG_NRF_MODEM_LIB_HEAP_SIZE=2048

Then my test case where I turn off recv() will not cause the modem_lib to get hung up.

In any case,   not reading a socket fast enough should never cause the underlying modem library to lock up.    Can I get source code to see why this is the case?   Or can you please ask one of the developers?  I noticed that there are only binary blobs in nrf connect sdk.

I think the underlying issue will trigger if several packets come in quickly.    I believe the modem library should simply drop packets if there is a memory allocation issue.

I would like to at least see if there is a way I can see if there is an ASSERT, etc firing in this case.   It really looks like there is a heap failure and the modem lib is locked up.

[emh203]

I have been able to narrow down the issue even further. My goal was to figure out how to trigger the issue on demand and then make it better/worse.    Also,  I was able to use Segger Ozone w/ Zephyr thread aware debugging to see what is happening.

 Test 1 -   Simple UDP Server Response - No recv()

I have a dedicated zephyr thread that will open/connect to UDP socket on a server.     I will send a small message to the server every 10 seconds and it will respond with 4 small data packets.      

In my UDP thread,   I disable recv().

The thread will get locked up almost immediately.      I found that the thread is lockup up waiting on a semaphore.  See attached image

It looks like the thread is blocked @ interface_socket_wait()

If I change this parameter:

CONFIG_NRF_MODEM_LIB_HEAP_SIZE=2048

The thread will no longer lock up immediately .     It would take longer but it would eventually lock up.

Test 2 -   Simple UDP Server Response -  Enable recv()

Same as #1 but instead I perform a recv() every 100mS to read incoming packets.

In this test case,   the thread will work for awhile but will eventual get to a locked state *even with recv()* calls.   It can take several hours but it will eventually happen

The server responds to my client with 4 packets.       Packet one is 40 bytes and Packet 2,3 and 4 are 96 bytes.       Packets 1 and 2 are sent immediately and 2,3 and 4 are spaced by 50mS

It feels like the back to back packets might be an issue.

Test 3 - Simple TCP Server w/ Netcat

This test can be used to easily replicate the issue.    In my test thread,  I would connect to a remote server using TCP instead of UDP:

client_fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); 

On the server side,  I could use netcat to accept connections.         I would then simply paste data in the console to send data.

A.)    In my test thread,   I disabled recv() calls.       The thread would lock up almost immediately when the server response.    The thread will also block at the same place as test #1

B.)  Changing to CONFIG_NRF_MODEM_LIB_HEAP_SIZE=2048   helps the problem but it is still possible to lock it up.

C.)  If I enable recv() with a 100mS read rate in my thread,    the thread will still eventually lock up.  

Conclusion:

I believe there is a memory allocation issue in the modem library.  Increasing the heap size helps but does not fix the issue.    Even when periodically calling recv(),   it will eventually block in the interface_socket_wait semaphore.

I would appreciate a developer to looking at the the modem_lib code as it is not provided in nrf_connect sdk.          The problem can be easily recreated w/ netcat on a test server.

While I understand the need to recv() to read data,  I believe it is a serious bug for the modem library to ever block indefinitely.    Data should simply be dropped.

 

My only workaround at this point is to enable the watchdog to reset the CPU.    This is occurring with a trivial socket use case with small amounts of data.

[Didrik Rokhaug]

emh203 said:

While I understand the need to recv() to read data,  I believe it is a serious bug for the modem library to ever block indefinitely.    Data should simply be dropped.

 We can't drop the data as that would break TCP amongst other things.

But, it also looks like you have found a memory leak. Could you turn on the modem_lib diagnostics and send us the log?

CONFIG_NRF_MODEM_LIB_DEBUG_ALLOC=y
CONFIG_NRF_MODEM_LIB_DEBUG_SHM_TX_ALLOC=y
CONFIG_NRF_MODEM_LIB_HEAP_DUMP_PERIODIC=y
CONFIG_NRF_MODEM_LIB_SHM_TX_DUMP_PERIODIC=y
CONFIG_NRF_MODEM_LIB_LOG_LEVEL_DBG=y

[emh203]

Hello Didrik:

I was able to turn on those diagnostics and gather a log.     Also,    I used the UDP example in 

nrf/samples/nrf9160/udp

to demonstrate the issue on the NRF9160DK

Setup:

1.) Build the sample in nrf/samples/nrf9160/udp

I added the following to the prj.conf

CONFIG_NRF_MODEM_LIB_DEBUG_ALLOC=y

CONFIG_NRF_MODEM_LIB_DEBUG_SHM_TX_ALLOC=y

CONFIG_NRF_MODEM_LIB_HEAP_DUMP_PERIODIC=y

CONFIG_NRF_MODEM_LIB_SHM_TX_DUMP_PERIODIC=y

CONFIG_NRF_MODEM_LIB_LOG_LEVEL_DBG=y

CONFIG_UDP_DATA_UPLOAD_SIZE_BYTES=10

CONFIG_UDP_DATA_UPLOAD_FREQUENCY_SECONDS=10

CONFIG_UDP_SERVER_ADDRESS_STATIC="104.236.49.95"

CONFIG_UDP_SERVER_PORT=2100

CONFIG_UDP_PSM_ENABLE=n

CONFIG_UDP_EDRX_ENABLE=n

CONFIG_UDP_RAI_ENABLE=n

Note:   The IP address and port is for a test server.     

2.)   Start the UDP test script on the test server.   I have attached "udp_test.py" to this    This code was started on the server terminal:

python3 udp_test.py

This code listens on port 2100 (a random test port I picked).   It will print the received data and then send back the string "Hello UDP Client"  six times for every message it receives.  I chose six as it will trigger the issue a bit quicker.

3.)   Start the UDP Sample and capture the output/log messages via putty.

Results:

See NRF9160_putty.log.   This is the all the printk/log messages from boot until the program stops.   You will be able to see where the memory allocation fails.

Once the failure occurs,   the function to periodically send data on the work queue will stop.     

Note:   In this sample,  incoming is never read as it will trigger the issue more quickly.     I initially found that the issue will still eventually occur even if the socket is periodically read. (it might take several hours or days)

In this test setup,  the fault will occur after 4 transmissions from the client.   Here is the terminal output from the python script.

forge@quaint-crater:~$ python3 udp_test.py
UDP server up and listening
Message from Client:b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
Client IP Address:('12.153.231.186', 60881)
Message from Client:b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
Client IP Address:('12.153.231.186', 60881)
Message from Client:b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
Client IP Address:('12.153.231.186', 60881)
Message from Client:b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
Client IP Address:('12.153.231.186', 60881)

Here is the putty log from the NRF9160.  Note that I captured data until the modem_lib process locked up.

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.06.01 11:22:21 =~=~=~=~=~=~=~=~=~=~=~=
I: alloc(16) -> 0x200154f4
I: alloc(12) -> 0x2001550c
*** Booting Zephyr OS build v2.4.99-ncs1-3525-g4d068de3f50f  ***
I: alloc(16) -> 0x2001551c
I: alloc(12) -> 0x20015534
UDP sample has started
I: shm_tx_alloc(15) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(9) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(11) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(22) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(9) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
nrf_modem tx dump:
Heap at 0x200104e8 contains 1023 units in 10 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        9          512            1         1016         8124

8124 free bytes, 0 allocated bytes, overhead = 64 bytes (0.8%)
Failed allocations: 0
nrf_modem heap dump:
Heap at 0x200154c0 contains 127 units in 7 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        6           64            1          111          884

884 free bytes, 64 allocated bytes, overhead = 72 bytes (7.1%)
Failed allocations: 0
nrf_modem tx dump:
Heap at 0x200104e8 contains 1023 units in 10 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        9          512            1         1016         8124

8124 free bytes, 0 allocated bytes, overhead = 64 bytes (0.8%)
Failed allocations: 0
nrf_modem heap dump:
Heap at 0x200154c0 contains 127 units in 7 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        6           64            1          111          884

884 free bytes, 64 allocated bytes, overhead = 72 bytes (7.1%)
Failed allocations: 0
nrf_modem tx dump:
Heap at 0x200104e8 contains 1023 units in 10 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        9          512            1         1016         8124

8124 free bytes, 0 allocated bytes, overhead = 64 bytes (0.8%)
Failed allocations: 0
nrf_modem heap dump:
Heap at 0x200154c0 contains 127 units in 7 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        6           64            1          111          884

884 free bytes, 64 allocated bytes, overhead = 72 bytes (7.1%)
Failed allocations: 0
I: alloc(20) -> 0x20015544
I: free(0x20015544)
LTE cell changed: Cell ID: 61774082, Tracking area: 61706
I: alloc(20) -> 0x20015544
I: free(0x20015544)
RRC mode: Connected
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
RRC mode: Idle

I: alloc(20) -> 0x20015544
I: free(0x20015544)
LTE cell changed: Cell ID: 122020869, Tracking area: 22018
I: alloc(20) -> 0x20015544
I: free(0x20015544)
RRC mode: Connected
I: alloc(20) -> 0x20015544
I: free(0x20015544)
RRC mode: Idle

I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
RRC mode: Connected
I: alloc(20) -> 0x20015544
I: free(0x20015544)
Network registration status: Connected - roaming

I: alloc(16) -> 0x20015544
I: alloc(12) -> 0x2001555c
PSTransmitting UDP/IP payload of 38 bytes to the IP address 104.236.49.95, port number 2100
I: shm_tx_alloc(10) -> 0x20010524
M parameter update: TAU: -1, Active time: -1
I: shm_tx_free(0x20010524)
I: alloc(16) -> 0x2001556c
I: alloc(20) -> 0x20015584
I: alloc(16) -> 0x2001559c
I: alloc(20) -> 0x200155b4
I: alloc(16) -> 0x200155cc
I: alloc(20) -> 0x200155e4
I: alloc(16) -> 0x200155fc
I: alloc(20) -> 0x20015614
I: alloc(16) -> 0x2001562c
I: alloc(20) -> 0x20015644
I: alloc(16) -> 0x2001565c
I: alloc(20) -> 0x20015674
nrf_modem tx dump:
Heap at 0x200104e8 contains 1023 units in 10 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        9          512            1         1016         8124

8124 free bytes, 0 allocated bytes, overhead = 64 bytes (0.8%)
Failed allocations: 0
nrf_modem heap dump:
Heap at 0x200154c0 contains 127 units in 7 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        6           64            1           70          556

556 free bytes, 336 allocated bytes, overhead = 128 bytes (12.5%)
Failed allocations: 0
Transmitting UDP/IP payload of 38 bytes to the IP address 104.236.49.95, port number 2100
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(16) -> 0x2001568c
I: alloc(20) -> 0x200156a4
I: alloc(16) -> 0x200156bc
I: alloc(20) -> 0x200156d4
I: alloc(16) -> 0x200156ec
I: alloc(20) -> 0x20015704
I: alloc(16) -> 0x2001571c
I: alloc(20) -> 0x20015734
I: alloc(16) -> 0x2001574c
I: alloc(20) -> 0x20015764
I: alloc(16) -> 0x2001577c
I: alloc(20) -> 0x20015794
Transmitting UDP/IP payload of 38 bytes to the IP address 104.236.49.95, port number 2100
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(16) -> 0x200157ac
I: alloc(20) -> 0x200157c4
I: alloc(16) -> 0x200157dc
I: alloc(20) -> 0x200157f4
I: alloc(16) -> 0x2001580c
I: alloc(20) -> 0x20015824
I: alloc(16) -> 0x2001583c
I: alloc(20) -> 0x20015854
I: alloc(16) -> 0x2001586c
I: alloc(20) -> 0x20015884
I: alloc(16) -> 0x2001589c
W: alloc(20) -> (nil)
W: alloc(16) -> (nil)
nrf_modem tx dump:
Heap at 0x200104e8 contains 1023 units in 10 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        9          512            1         1016         8124

8124 free bytes, 0 allocated bytes, overhead = 64 bytes (0.8%)
Failed allocations: 0
nrf_modem heap dump:
Heap at 0x200154c0 contains 127 units in 7 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        0            1            1            1            4

4 free bytes, 796 allocated bytes, overhead = 220 bytes (21.6%)
Failed allocations: 2
Transmitting UDP/IP payload of 38 bytes to the IP address 104.236.49.95, port number 2100
I: shm_tx_alloc(10) -> 0x20010524
W: alloc(16) -> (nil)
W: alloc(16) -> (nil)
W: alloc(16) -> (nil)
W: alloc(16) -> (nil)
W: alloc(16) -> (nil)

Fullscreen nrf9160_putty.log Download

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.06.01 11:22:21 =~=~=~=~=~=~=~=~=~=~=~=
I: alloc(16) -> 0x200154f4
I: alloc(12) -> 0x2001550c
*** Booting Zephyr OS build v2.4.99-ncs1-3525-g4d068de3f50f  ***
I: alloc(16) -> 0x2001551c
I: alloc(12) -> 0x20015534
UDP sample has started
I: shm_tx_alloc(15) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(9) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(11) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(22) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: shm_tx_alloc(9) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
nrf_modem tx dump:
Heap at 0x200104e8 contains 1023 units in 10 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        9          512            1         1016         8124

8124 free bytes, 0 allocated bytes, overhead = 64 bytes (0.8%)
Failed allocations: 0
nrf_modem heap dump:
Heap at 0x200154c0 contains 127 units in 7 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        6           64            1          111          884

884 free bytes, 64 allocated bytes, overhead = 72 bytes (7.1%)
Failed allocations: 0
nrf_modem tx dump:
Heap at 0x200104e8 contains 1023 units in 10 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        9          512            1         1016         8124

8124 free bytes, 0 allocated bytes, overhead = 64 bytes (0.8%)
Failed allocations: 0
nrf_modem heap dump:
Heap at 0x200154c0 contains 127 units in 7 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        6           64            1          111          884

884 free bytes, 64 allocated bytes, overhead = 72 bytes (7.1%)
Failed allocations: 0
nrf_modem tx dump:
Heap at 0x200104e8 contains 1023 units in 10 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        9          512            1         1016         8124

8124 free bytes, 0 allocated bytes, overhead = 64 bytes (0.8%)
Failed allocations: 0
nrf_modem heap dump:
Heap at 0x200154c0 contains 127 units in 7 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        6           64            1          111          884

884 free bytes, 64 allocated bytes, overhead = 72 bytes (7.1%)
Failed allocations: 0
I: alloc(20) -> 0x20015544
I: free(0x20015544)
LTE cell changed: Cell ID: 61774082, Tracking area: 61706
I: alloc(20) -> 0x20015544
I: free(0x20015544)
RRC mode: Connected
I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
RRC mode: Idle

I: alloc(20) -> 0x20015544
I: free(0x20015544)
LTE cell changed: Cell ID: 122020869, Tracking area: 22018
I: alloc(20) -> 0x20015544
I: free(0x20015544)
RRC mode: Connected
I: alloc(20) -> 0x20015544
I: free(0x20015544)
RRC mode: Idle

I: alloc(20) -> 0x20015544
I: free(0x20015544)
I: alloc(20) -> 0x20015544
I: free(0x20015544)
RRC mode: Connected
I: alloc(20) -> 0x20015544
I: free(0x20015544)
Network registration status: Connected - roaming

I: alloc(16) -> 0x20015544
I: alloc(12) -> 0x2001555c
PSTransmitting UDP/IP payload of 38 bytes to the IP address 104.236.49.95, port number 2100
I: shm_tx_alloc(10) -> 0x20010524
M parameter update: TAU: -1, Active time: -1
I: shm_tx_free(0x20010524)
I: alloc(16) -> 0x2001556c
I: alloc(20) -> 0x20015584
I: alloc(16) -> 0x2001559c
I: alloc(20) -> 0x200155b4
I: alloc(16) -> 0x200155cc
I: alloc(20) -> 0x200155e4
I: alloc(16) -> 0x200155fc
I: alloc(20) -> 0x20015614
I: alloc(16) -> 0x2001562c
I: alloc(20) -> 0x20015644
I: alloc(16) -> 0x2001565c
I: alloc(20) -> 0x20015674
nrf_modem tx dump:
Heap at 0x200104e8 contains 1023 units in 10 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        9          512            1         1016         8124

8124 free bytes, 0 allocated bytes, overhead = 64 bytes (0.8%)
Failed allocations: 0
nrf_modem heap dump:
Heap at 0x200154c0 contains 127 units in 7 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        6           64            1           70          556

556 free bytes, 336 allocated bytes, overhead = 128 bytes (12.5%)
Failed allocations: 0
Transmitting UDP/IP payload of 38 bytes to the IP address 104.236.49.95, port number 2100
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(16) -> 0x2001568c
I: alloc(20) -> 0x200156a4
I: alloc(16) -> 0x200156bc
I: alloc(20) -> 0x200156d4
I: alloc(16) -> 0x200156ec
I: alloc(20) -> 0x20015704
I: alloc(16) -> 0x2001571c
I: alloc(20) -> 0x20015734
I: alloc(16) -> 0x2001574c
I: alloc(20) -> 0x20015764
I: alloc(16) -> 0x2001577c
I: alloc(20) -> 0x20015794
Transmitting UDP/IP payload of 38 bytes to the IP address 104.236.49.95, port number 2100
I: shm_tx_alloc(10) -> 0x20010524
I: shm_tx_free(0x20010524)
I: alloc(16) -> 0x200157ac
I: alloc(20) -> 0x200157c4
I: alloc(16) -> 0x200157dc
I: alloc(20) -> 0x200157f4
I: alloc(16) -> 0x2001580c
I: alloc(20) -> 0x20015824
I: alloc(16) -> 0x2001583c
I: alloc(20) -> 0x20015854
I: alloc(16) -> 0x2001586c
I: alloc(20) -> 0x20015884
I: alloc(16) -> 0x2001589c
W: alloc(20) -> (nil)
W: alloc(16) -> (nil)
nrf_modem tx dump:
Heap at 0x200104e8 contains 1023 units in 10 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        9          512            1         1016         8124

8124 free bytes, 0 allocated bytes, overhead = 64 bytes (0.8%)
Failed allocations: 0
nrf_modem heap dump:
Heap at 0x200154c0 contains 127 units in 7 buckets

  bucket#    min units        total      largest      largest
             threshold       chunks      (units)      (bytes)
  -----------------------------------------------------------
        0            1            1            1            4

4 free bytes, 796 allocated bytes, overhead = 220 bytes (21.6%)
Failed allocations: 2
Transmitting UDP/IP payload of 38 bytes to the IP address 104.236.49.95, port number 2100
I: shm_tx_alloc(10) -> 0x20010524
W: alloc(16) -> (nil)
W: alloc(16) -> (nil)
W: alloc(16) -> (nil)
W: alloc(16) -> (nil)
W: alloc(16) -> (nil)

Fullscreen udp_test.py Download

import socket


localIP     = "104.236.49.95"

localPort   = 2100

bufferSize  = 1024

msgFromServer       = "Hello UDP Client"

bytesToSend         = str.encode(msgFromServer)

# Create a datagram socket

UDPServerSocket = socket.socket(family=socket.AF_INET, type=socket.SOCK_DGRAM)

 

# Bind to address and ip

UDPServerSocket.bind((localIP, localPort))

 

print("UDP server up and listening")

 

# Listen for incoming datagrams

while(True):

    bytesAddressPair = UDPServerSocket.recvfrom(bufferSize)

    message = bytesAddressPair[0]

    address = bytesAddressPair[1]

    clientMsg = "Message from Client:{}".format(message)
    clientIP  = "Client IP Address:{}".format(address)
    
    print(clientMsg)
    print(clientIP)
  

    # Sending a reply to client

    UDPServerSocket.sendto(bytesToSend, address)
    UDPServerSocket.sendto(bytesToSend, address)
    UDPServerSocket.sendto(bytesToSend, address)
    UDPServerSocket.sendto(bytesToSend, address)
    UDPServerSocket.sendto(bytesToSend, address)
    UDPServerSocket.sendto(bytesToSend, address)

Fullscreen ServerOutput.txt Download

forge@quaint-crater:~$ python3 udp_test.py
UDP server up and listening
Message from Client:b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
Client IP Address:('12.153.231.186', 60881)
Message from Client:b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
Client IP Address:('12.153.231.186', 60881)
Message from Client:b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
Client IP Address:('12.153.231.186', 60881)
Message from Client:b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
Client IP Address:('12.153.231.186', 60881)