From owner-freebsd-questions@FreeBSD.ORG Thu Mar 22 19:00:27 2007 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 426C416A401 for ; Thu, 22 Mar 2007 19:00:27 +0000 (UTC) (envelope-from tg@swox.com) Received: from king.swox.se (king.swox.se [195.198.203.150]) by mx1.freebsd.org (Postfix) with ESMTP id E181613C4D3 for ; Thu, 22 Mar 2007 19:00:26 +0000 (UTC) (envelope-from tg@swox.com) Received: by king.swox.se (Postfix, from userid 1001) id 9709F7DB8; Thu, 22 Mar 2007 20:00:27 +0100 (CET) To: Chuck Swiger References: <868xdqnnzd.fsf@king.swox.se> From: Torbjorn Granlund Sender: tege@king.swox.se Original-Sender: tg@swox.com Date: 22 Mar 2007 20:00:27 +0100 In-Reply-To: Message-ID: <86odmlhzn8.fsf@king.swox.se> Lines: 53 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.3 MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Cc: freebsd-questions@freebsd.org Subject: Re: TCP conection problems IBM VM -> FreeBSD X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Mar 2007 19:00:27 -0000 Chuck Swiger writes: On Mar 21, 2007, at 5:03 PM, Torbjorn Granlund wrote: When vm attempts to make a TCP connection (e.g., on port 25) to smtp.swox.se I see the following traffic on the router: 22:46:27.015389 IP vm.se.lsoft.com.47218 > smtp.swox.se.smtp: S 27523124:27523124(0) win 8192 22:46:27.015523 IP smtp.swox.se.smtp > vm.se.lsoft.com.47218: S 1745147473:1745147473(0) ack 3530628660 win 57344 22:46:27.056277 IP vm.se.lsoft.com.47218 > smtp.swox.se.smtp: R 3530628660:3530628660(0) win 0 I.e., the vm box appears to dislike the SYNACK from smtp.swox.se, and sends an RST. One might ask if it is the fault of vm or of smtp.swox.se. The second line should have been smtp.swox.se.smtp SYN+ACK'ing the ISN of 27523124. vm is sending a RST to that because the sequence #'s don't match. It's also odd that the set of options being listed don't correspond at all...if you run the tcpdump for several minutes, can you track down other SYN requests which do correspond? These are the ones the correspond. They come in bursts like that. If I let it run a little longer, I get output like this: 19:45:56.939958 IP vm.se.lsoft.com.58679 > bang.swox.se.smtp: S 678305700:678305700(0) win 8192 19:45:56.940154 IP bang.swox.se.smtp > vm.se.lsoft.com.58679: S 3183232720:3183232720(0) ack 678305701 win 57344 19:45:56.974421 IP vm.se.lsoft.com.58679 > bang.swox.se.smtp: R 678305701:678305701(0) win 0 19:45:59.939737 IP vm.se.lsoft.com.58679 > bang.swox.se.smtp: S 678305700:678305700(0) win 8192 19:45:59.939905 IP bang.swox.se.smtp > vm.se.lsoft.com.58679: S 1749284606:1749284606(0) ack 678305701 win 57344 19:45:59.978666 IP vm.se.lsoft.com.58679 > bang.swox.se.smtp: R 678305701:678305701(0) win 0 19:46:05.940041 IP vm.se.lsoft.com.58679 > bang.swox.se.smtp: S 678305700:678305700(0) win 8192 19:46:05.940205 IP bang.swox.se.smtp > vm.se.lsoft.com.58679: S 2664894402:2664894402(0) ack 678305701 win 57344 19:46:05.977251 IP vm.se.lsoft.com.58679 > bang.swox.se.smtp: R 678305701:678305701(0) win 0 The ISN's don't match here either. Sometimes this kind of re-writing can happen if natd or PF is attempting to translate the packets, perhaps when they shouldn't if both sides of your router box are using routable IPs.... I don't run natd at all, and to get the output above from tcpdump I had disabled pf with pfctl -d. With pf running, it silently drops the 2nd packet. Could that too be related to ISN's? The outside of the fbsd 6.2 router has two addresses, one routable and one not routable. This is due to the default setup my ISP is providing: Their is a little net 192.168.0.0/30 between their router and my fbsd 6.2 router. (I have a routable address on the interface in order to allow pf's nat to provide a sensible return address for the nat'ed packets.) -- Torbjörn