From owner-freebsd-hackers Tue Sep 16 07:35:43 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id HAA26936 for hackers-outgoing; Tue, 16 Sep 1997 07:35:43 -0700 (PDT) Received: from innocence.interface-business.de (innocence.interface-business.de [193.101.57.202]) by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id HAA26925 for ; Tue, 16 Sep 1997 07:35:36 -0700 (PDT) Received: from ida.interface-business.de (ida.interface-business.de [193.101.57.203]) by innocence.interface-business.de (8.6.11/8.6.9) with SMTP id QAA28880 for ; Tue, 16 Sep 1997 16:35:27 +0200 Received: (from j@localhost) by ida.interface-business.de (8.8.7/8.7.3) id QAA05352; Tue, 16 Sep 1997 16:35:26 +0200 (MET DST) Message-ID: <19970916163525.KH02502@ida.interface-business.de> Date: Tue, 16 Sep 1997 16:35:25 +0200 From: j@ida.interface-business.de (J Wunsch) To: freebsd-hackers@freebsd.org (FreeBSD hackers) Subject: Any TCP expert around? X-Mailer: Mutt 0.60_p2-3,5,8-9 Mime-Version: 1.0 X-Phone: +49-351-31809-14 X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E Organization: interface business GmbH, Dresden Reply-To: joerg_wunsch@interface-business.de (Joerg Wunsch) Sender: owner-freebsd-hackers@freebsd.org X-Loop: FreeBSD.org Precedence: bulk Whenever one of our FreeBSD machines contacts icon-gw.icon.de, the TCP connections breaks off in an endless flood of FIN-ack packets. Sorry for the messy data below, but it's hard to cut something off without losing information. That's a pretty normal HTTP connection, but towards the end, 193.102.86.65 doesn't seem to confirm the FIN flag, thus 193.101.57.200 remains in FIN_WAIT_1, and tries to resend the FIN flag over and over again, 7 minutes long. 193.101.57.200 is FreeBSD 2.2-something, running a plain FreeBSD TCP stack. 193.102.86.65 is supposedly running on a Sun, and for sure is using a Firewall-1. Using a Win95 client doesn't show this behaviour, only three or four FIN-ack pairs are flowing (and in much slower sequence), then the connection closes normally. What makes me a little nervous is the couple of packets sent by the FreeBSD side at 15:39.54.132386 and 15:39:54.133176. Why are there two packets? Whom to blame? 15:25:18.841146 193.101.57.200.4315 > 193.102.86.65.80: S 1036553716:1036553716(0) win 16384 (DF) 15:25:18.968586 193.102.86.65.80 > 193.101.57.200.4315: S 2661360185:2661360185(0) ack 1036553717 win 16384 (DF) 15:25:18.969441 193.101.57.200.4315 > 193.102.86.65.80: . ack 1 win 17280 (DF) 15:25:18.971094 193.101.57.200.4315 > 193.102.86.65.80: P 1:302(301) ack 1 win 17280 (DF) 15:25:19.076801 193.102.86.65.80 > 193.101.57.200.4315: S 124354575:124354575(0) ack 1036553717 win 9112 (DF) 15:25:19.077605 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:25:19.421201 193.102.86.65.80 > 193.101.57.200.4315: P 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:25:19.422060 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:25:22.232647 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:25:22.233438 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:25:27.865288 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:25:27.866084 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:25:28.200088 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:25:28.200881 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:25:39.142384 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:25:39.143176 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:26:01.614174 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:26:01.614970 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:26:46.615095 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:26:46.615889 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:27:42.930938 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:27:42.931799 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:28:39.125648 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:28:39.126675 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:29:35.367423 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:29:35.368217 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:30:31.616148 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:30:31.617006 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:31:27.871339 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:31:27.872302 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:32:24.129971 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:32:24.130754 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:33:20.377428 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:33:20.378275 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:35:12.911454 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:35:12.912244 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:37:05.431756 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:37:05.432548 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:38:01.680078 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:38:01.680915 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:38:57.950193 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:38:57.951151 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:39:54.132386 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:39:54.133176 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 (DF) 15:40:19.392871 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 (DF) 15:40:19.570522 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:40:19.571305 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 (DF) 15:40:19.712133 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:40:19.712916 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 (DF) 15:40:19.858971 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) ... 15:47:23.799609 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 (DF) 15:47:23.805337 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:47:23.806153 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 (DF) 15:47:23.859484 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:47:23.860302 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 (DF) 15:47:23.866083 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:47:23.866914 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 (DF) 15:47:23.959676 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:47:23.960497 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 (DF) 15:47:24.089870 193.102.86.65.80 > 193.101.57.246.1038: P 1282040329:1282040865(536) ack 174 win 9112 (DF) 15:47:24.095168 193.102.86.65.80 > 193.101.57.200.4315: R 2661360186:2661360186(0) win 0 (DF) 15:47:24.124285 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:47:24.125056 193.101.57.200.4315 > 193.102.86.65.80: R 1036554019:1036554019(0) win 0 -- J"org Wunsch Unix support engineer joerg_wunsch@interface-business.de http://www.interface-business.de/~j