From owner-freebsd-questions@FreeBSD.ORG Thu Feb 16 03:53:05 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 157D216A422 for ; Thu, 16 Feb 2006 03:53:05 +0000 (GMT) (envelope-from jbell@stelesys.com) Received: from stelesys.com (web3.stelesys.com [63.175.100.43]) by mx1.FreeBSD.org (Postfix) with ESMTP id AB31943D48 for ; Thu, 16 Feb 2006 03:53:04 +0000 (GMT) (envelope-from jbell@stelesys.com) Received: from c-71-199-184-251.hsd1.ga.comcast.net ([71.199.184.251] helo=[192.168.0.148]) by stelesys.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.60 (FreeBSD)) (envelope-from ) id 1F9aCJ-0003PC-Hc; Wed, 15 Feb 2006 22:52:51 -0500 Message-ID: <43F3F70F.6040205@stelesys.com> Date: Wed, 15 Feb 2006 22:52:47 -0500 From: Jerry Bell User-Agent: Thunderbird 1.5 (Windows/20051201) MIME-Version: 1.0 To: Ted Mittelstaedt References: In-Reply-To: Content-Type: text/plain; charset=windows-1250; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: Help with strange web server problem X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Feb 2006 03:53:05 -0000 Path MTU problem? >> > > That would be my vote also. > > Ted > > I've done some more troubleshooting and some strange things have appeared. First, the colo says there is NO proxy, and NO firewall in front of this server. I captured a misfire on both the server and on my freebsd gateway. The two traffic flows don't seem to quite line up. First, here is the view from the server: www# tcpdump -tttt -vvv -A port 80 tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes 2006-02-15 22:18:11.014600 IP (tos 0x0, ttl 110, id 10713, offset 0, flags [DF], length: 48) c-71-199-184-251.hsd1.ga.comcast.net.3945 > www.musiclodge.com.http: S [tcp sum ok] 1671172334:1671172334(0) win 64512 E..0).@.n.>QG...?.d,.i.Pc.......p..._........... 2006-02-15 22:18:11.014650 IP (tos 0x0, ttl 64, id 34040, offset 0, flags [DF], length: 48) www.musiclodge.com.http > c-71-199-184-251.hsd1.ga.comcast.net.3945: S [bad tcp cksum a4c0 (->9a1f)!] 1547658190:1547658190(0) ack 1671172335 win 65535 E..0..@.@..2?.d,G....P.i\?c.c...p............... 2006-02-15 22:18:11.060824 IP (tos 0x0, ttl 110, id 10715, offset 0, flags [DF], length: 40) c-71-199-184-251.hsd1.ga.comcast.net.3945 > www.musiclodge.com.http: . [tcp sum ok] 1:1(0) ack 1086692403 win 64856 E..().@.n.>WG...?.d,.i.Pc.......P..X.......... 2006-02-15 22:18:11.060837 IP (tos 0x0, ttl 64, id 60576, offset 0, flags [DF], length: 40) www.musiclodge.com.http > c-71-199-184-251.hsd1.ga.comcast.net.3945: R [bad tcp cksum a4b8 (->5e83)!] 2634350593:2634350593(0) win 0 E..(..@.@...?.d,G....P.i........P....... 2006-02-15 22:18:11.065196 IP (tos 0x0, ttl 110, id 10716, offset 0, flags [DF], length: 40) c-71-199-184-251.hsd1.ga.comcast.net.3945 > www.musiclodge.com.http: . [tcp sum ok] 387:387(0) ack 1086692403 win 64856 E..().@.n.>VG...?.d,.i.Pc..q....P..X.......... 2006-02-15 22:18:11.065208 IP (tos 0x0, ttl 64, id 4488, offset 0, flags [DF], length: 40) www.musiclodge.com.http > c-71-199-184-251.hsd1.ga.comcast.net.3945: R [bad tcp cksum a4b8 (->5e83)!] 2634350593:2634350593(0) win 0 E..(..@.@...?.d,G....P.i........P....... 2006-02-15 22:18:11.069569 IP (tos 0x0, ttl 110, id 10717, offset 0, flags [DF], length: 426) c-71-199-184-251.hsd1.ga.comcast.net.3945 > www.musiclodge.com.http: P 1:387(386) ack 1086692403 win 64856 E...).@.n.<.G...?.d,.i.Pc.......P..X'1..GET / HTTP/1.1 Accept: image/gif, image/x 2006-02-15 22:18:11.069579 IP (tos 0x0, ttl 64, id 40159, offset 0, flags [DF], length: 40) www.musiclodge.com.http > c-71-199-184-251.hsd1.ga.comcast.net.3945: R [bad tcp cksum a4b8 (->5e83)!] 2634350593:2634350593(0) win 0 E..(..@.@..R?.d,G....P.i........P....... 2006-02-15 22:18:14.014594 IP (tos 0x0, ttl 64, id 12734, offset 0, flags [DF], length: 48) www.musiclodge.com.http > c-71-199-184-251.hsd1.ga.comcast.net.3945: S [bad tcp cksum a4c0 (->9a1f)!] 1547658190:1547658190(0) ack 1671172335 win 65535 E..01.@.@.dl?.d,G....P.i\?c.c...p............... 2006-02-15 22:18:14.073367 IP (tos 0x0, ttl 110, id 10734, offset 0, flags [none], length: 40) c-71-199-184-251.hsd1.ga.comcast.net.3945 > www.musiclodge.com.http: R [tcp sum ok] 1671172335:1671172335(0) win 0 Next, here is the view from the gateway (time is off on that one): beta# tcpdump -tttt -vvv -A port 80 and host 63.175.100.44 tcpdump: listening on xl0, link-type EN10MB (Ethernet), capture size 96 bytes 2006-02-16 03:29:02.970756 IP (tos 0x0, ttl 128, id 10713, offset 0, flags [DF], length: 48) atllapjbell1.iss.local.3945 > www.musiclodge.com.http: S [tcp sum ok] 1671172334:1671172334(0) win 64512 E..0).@...k.....?.d,.i.Pc.......p............... 2006-02-16 03:29:03.016989 IP (tos 0x0, ttl 32, id 0, offset 0, flags [DF], length: 40) www.musiclodge.com.http > atllapjbell1.iss.local.3945: S [tcp sum ok] 2634350592:2634350592(0) ack 1671172335 win 64512 E..(..@. ...?.d,.....P.i....c...P...-p.. 2006-02-16 03:29:03.017099 IP (tos 0x0, ttl 45, id 34040, offset 0, flags [DF], length: 48) www.musiclodge.com.http > atllapjbell1.iss.local.3945: S [tcp sum ok] 1547658190:1547658190(0) ack 1671172335 win 65535 E..0..@.-.c.?.d,.....P.i\?c.c...p............... 2006-02-16 03:29:03.017963 IP (tos 0x0, ttl 128, id 10715, offset 0, flags [DF], length: 40) atllapjbell1.iss.local.3945 > www.musiclodge.com.http: . [tcp sum o k] 1:1(0) ack 1086692403 win 64856 E..().@...k.....?.d,.i.Pc.......P..X,......... 2006-02-16 03:29:03.018308 IP (tos 0x0, ttl 128, id 10716, offset 0, flags [DF], length: 40) atllapjbell1.iss.local.3945 > www.musiclodge.com.http: . [tcp sum o k] 387:387(0) ack 1086692403 win 64856 E..().@...k.....?.d,.i.Pc..q....P..X*......... 2006-02-16 03:29:03.018794 IP (tos 0x0, ttl 128, id 10717, offset 0, flags [DF], length: 426) atllapjbell1.iss.local.3945 > www.musiclodge.com.http: P 1:387(386 ) ack 1086692403 win 64856 E...).@...jY....?.d,.i.Pc.......P..Xf...GET / HTTP/1.1 Accept: image/gif, image/x 2006-02-16 03:29:03.062898 IP (tos 0x0, ttl 45, id 60576, offset 0, flags [DF], length: 40) www.musiclodge.com.http > atllapjbell1.iss.local.3945: R [tcp sum ok] 2634350593:2634350593(0) win 0 E..(..@.-...?.d,.....P.i........P.... .. 2006-02-16 03:29:03.066481 IP (tos 0x0, ttl 45, id 4488, offset 0, flags [DF],length: 40) www.musiclodge.com.http > atllapjbell1.iss.local.3945: R [tcp sum ok ] 2634350593:2634350593(0) win 0 E..(..@.-..0?.d,.....P.i........P.... .. 2006-02-16 03:29:03.071491 IP (tos 0x0, ttl 45, id 40159, offset 0, flags [DF], length: 40) www.musiclodge.com.http > atllapjbell1.iss.local.3945: R [tcp sum ok] 2634350593:2634350593(0) win 0 E..(..@.-.K.?.d,.....P.i........P.... .. 2006-02-16 03:29:06.017452 IP (tos 0x0, ttl 45, id 12734, offset 0, flags [DF], length: 48) www.musiclodge.com.http > atllapjbell1.iss.local.3945: S [tcp sum ok] 1547658190:1547658190(0) ack 1671172335 win 65535 E..01.@.-...?.d,.....P.i\?c.c...p............... 2006-02-16 03:29:06.019108 IP (tos 0x0, ttl 128, id 10734, offset 0, flags [none], length: 40) atllapjbell1.iss.local.3945 > www.musiclodge.com.http: R [tcp sum ok] 1671172335:1671172335(0) win 0 E..()...........?.d,.i.Pc...c...P...Q.....p..t This is the very same transaction. I'm not an expert at TCP/IP, but it looks like the server and the client are seeing things quite differently. Any additional help in tracking down what is happening is greatly appreciated. Thanks much! Jerry