Skip site navigation (1)Skip section navigation (2) 
Date:      Sat, 22 Oct 2005 22:01:46 +0100
From:      Volker <volker@vwsoft.com>
To:        Matthew Grooms <mgrooms@shrew.net>
Cc:        freebsd-net@freebsd.org
Subject:   Re: IPSec tcp session stalling ( me too ) ...
Message-ID:  <435AA8BA.6020808@vwsoft.com>
In-Reply-To: <435A85F7.3000909@shrew.net>
References:  <435A85F7.3000909@shrew.net>
next in thread | previous in thread | raw e-mail | index | archive | help 

[-- Attachment #1 --]
Matthew,

thanks for your reply. Glad to hear that I'm not the only one
experiencing this problem. So the problem is IPSec + firewall but not
related to pf or ipfw. Is it IPSec + bandwidth management??

I've tried a different test setup and just pushed a bunch of
(/dev/random) data over a tcp connection through the IPSec tunnel using:

	%gnetcat 10.128.1.6 49001 /dev/random
at host B (10.128.6.1) and did

	%netcat -l -p 49001 > netcat.out
on host A (10.128.1.6).

After the file 'netcat.out' reached the file size of 66.108 bytes
(around the same size as the scp transfer aborts every time) the tcp
stream has been closed with:

host B: write(net): Operation not permitted
host A: read(net): Connection reset by peer

I've managed to get a tcpdump of the gif interfaces on both hosts. Both
files are attached to this message (hostA.cap and hostB.cap). These
files viewed by ethereal gives a nice look at the tcp flow. There you
can see hostB sends three RST packets at the end (for whatever reason).

The only thing I've seen (looking a bit ugly) is that hostA answers
packets (ACK) before the data payload is being received. At least that's
the way tcpdump has seen these packets. That should be related to
priorisation of ACK packets using ALTQ.

Is anybody else here with deep TCP + IPSec knowledge able to get a look
into this? Any known issues? Is there anything I might also check out?
Is there a 64k limit with IPSec? :(

Thanks,

Volker


On 2005-10-22 19:33, Matthew Grooms wrote:
> Volker,
> 
>      I have noticed the same problem. In my case, it only seems to
> happen when the traffic is being forwarded across interfaces and pf or
> ipfw is enabled. I use purely IPSEC so I would agree that GRE isn't the
> problem. This behavior is 100% reproducible for me. If traffic is
> forwarded from the host providing the ESP protection or if the firewall
> package is disabled, the problem goes away.
> 
>      Just some data points. I don't recall seeing this ever happen on
> 4.x + ipfw. I experienced this on early 5.x + ipfw, late 5.x + pf and
> 6.x + pf. I believe the ipfw versions I tested were prior to the pfil
> hooks conversion.
> 
> For example ...
> 
> NODE 1 sftp client
> NODE 2 sftp server
> IPSEC policy requires ESP protection from NODE 1 or VPN A to NODE 2
> 
> NODE 1 ------ VPN A ===== VPN B ----- NODE 2
> 
> 1) NODE 1 <-> NODE 2 sftp via IPSEC pf enabled, traffic stalls
> 2) NODE 1 <-> NODE 2 sftp via IPSEC pf disabled, no problems
> 3) VPN A  <-> NODE 2 sftp via IPSEC pf enabled, no problems
> 
> NOTE : TCP protocol is irrelevant. Haven't tried UDP.

[-- Attachment #2 --]
ò`ZC*DDE@S@


ṿipџ[
SZC&DDE@@

ṿipџO
ZC͖DDE@t@A>

iṏpѠQ
#ZC88E4<@!

ṿipѠ
'#ZC`8E4%@5

ṿipѠG-
(#
$e!q-OǕ>4	K)y&2z4CCyؘQZC`E@9

ṿipՠU
(#aifd6(jB*}ms&Ύ#PZC`EX@!

ṿiplj
(#K,b/uY.{Ӓ0(<`.}r ݞnZCK88E4.@0

iṏpl
#(ZCK`E@l

ṿip8
V#Cţؾ7tDZ/cCFd@1tZCL`E<@r

ṿipE
V#SEM)y/,r=5u%yW<w.K0ZC|`88E41@S

iṏp8
#(ZC``E@7

ṿipЏF
[#3ô[V2D~Ԛo{p|ͩnb~ZCqa`E@

ṿip휏
[#fC+Kb%$~μ0'tKB'ƮZC88E4X@e

iṏpЀJ
#VZC`E@\

ṿiph
#̆BJxVٻ8I-4I(g̮ZC`E6@#^

ṿip4ѐ
#wr;,MA(e+/z<`TZC88E4@@}

iṏp휀
#[ZC`E~@

ṿipa]
#8VUFBxs8pԿն%aZCm88E4@K

iṏp4
#<[ZC`E@S

ṿiq̏H=
#<E儡lAʱeVsz
y#[z1ђZC_`E@4

ṿiqg
#<p^WnW!lj*fڔ?5%=͵XCZC88E4B8@

iṏpV
#BZC`Eȓ@^

ṿiq
dW
#B@jdOyeŠ}G^E*ZC`E@:o

ṿiq0>
#BTZqτ
)y!	ԺY)϶흓ms}-ZCF88E41@

iṏqx
#eZCG`E@w

ṿiq
#eܛG|+A!{{ߜWFXOZCG`E@%

ṿiqȏ/
#e
\2nx]Di Dl_4f:O#dZC_[88E4@Ħ

iṏq
dq
#kZC[`E@Tn

ṿiq-
#k/YS8ى՞ Nv5_ڏZCą88E4fR@k

iṏqj^
#vZC`Ej@

ṿiq"`?
#vui=3C6GEFNjƷ.ZC`E@?

ṿiq',
#vúI!{:'%i<,bμ:fWddqsZC88E4DG@w

iṏqȀb
#خZC>`E9@ 

ṿiq+*
#$-?ep/NEBL
3QO[πDZCg	88E4@

iṏq"`[
#خZC	`EY@k

ṿiq0ď
#_A樬\EyMX챛Kc4]]Pge'#ZCW	`E@J5

ṿiq5
#hGs%^|)Yܚ`|*[HFЮZC(	88E4r,@

iṏq',Ti
#讌ZC)	`E6@#S

ṿiq:\<
#N7 ?_ʎ4ϸ	~FK"_ZC	88E4@@[~

iṏq0ĀM
#讌ZC	`E@@R

ṿiq?(b
,#޷wxdP@
)v#D/cjO(	ZC	`E@Q

ṿiqC#
,#F,$luSk3
QQ`閅%_jZC	88E4$f@:X

iṏq5E
#ZC)	`E@Ti

ṿiqH=
5#÷p_8ԜHn\m7J+S݋ImkYZC	88E4@à

iṏq?(>
#ZC	`E@g

ṿiqM>
@#]~I19`RZ#MX?:9/ZC	`E@Dc

ṿiqRX,i
@#n|?`.Zp%5И:5`RgZC1
88E4m]@`

iṏqC7
#,ZC1
`EX@

ṿiqW$

U#/
{eJl?~Lbdg
ZC\
88E4\f@X

iṏqM/
#,ZC\
`E@G

ṿiq[&	
`#;L8㙑#sc&<g2pI
gwd`))"ZC]
`E@'

ṿiq`
a#xd%55QwJwR=,u뭆xtZC[~
88E4MO@o

iṏqRX(
#@ZC{~
`E@`

ṿiqe)
i#44"l+uK
MyP^Ψa+U{Y-ZC
88E4
B@Q|

iṏq[!F
#
@ZC
`E@m.

ṿiqjT
~#
RbZ]BNt OuuRw^2K;GZC
`E\@

ṿiqo z
#
zcZʗ=ie:e
:DUMOSQ̾>ZC
88E4"@Λ

iṏq`
#`ZC
`E2@'l

ṿiqs쏮P
#錗E0~sRQR՜;ēN"K1֘ՁZC(88E4E-@

iṏqjT
#"aZC(`E@

ṿiqx|
#"thʪ[j"SG ⏭EQ27WZC)`E@

ṿiq}
#"ͤѰ#yV04pw`/ѡ7ðw~qZC*`E@?

ṿiqPt
#"m?Lye^eC,կt./~(ZCMt88E4V@g

iṏqo I
#6~ZC88E4B5@

iṏqx
#AZC`E@

ṿiqS
#A/K1muVuO4R=Nrq_WY!}ZC`E@FX

ṿiq菮+
#A΃ȀvV(?DNh4eC!ZCo`E{@_

ṿiqfo
#A'rW-yGFJȠQ񛺥hu讌ZC88E4!H@=v

iṏq}
#LZC`E@a

ṿiq:
#L7n}2Q1+e֟5T(7ZCO88E4s@

iṏqz
#WZCk`E@

ṿiqLȫ
#WQS?! bKJ;TqU!Y,w7z2w]!ZC>`E@g

ṿiqȄ
#WMt
fS|`q7"ABPĉuꮌZC?88E4(@

iṏq
#jZC#?`E@

ṿiq䏮
#j[\لf,*jqXe`BP]][ZC*j88E4z@~C

iṏq
#uZCEj`Ḛ@A

ṿiq#T
#u|CJ"?l/V^8R@E@P3^W%
1rZCk`E#@6

ṿiq|v
#u(|PJa{f9R.1o^Pu#	-ZCn88E4@

iṏqLߗ
#{ZC`E'@2

ṿiqHF
#{<c|<qԢ|&!d@b1y먮ZCS88E4S@j

iṏqO
#ɮZCo`E@D

ṿiqk
#L.5Y
zj	ɡ<`,S<7YOa?ZZCC`E؆@k

ṿiq
#P
)9l1ډ%Qe"H	:S"R	ZC88E4@

iṏq
#ܮZC`Eu@1

ṿiq
#$9V"EĿJؒ4
h#IC?٫ZCV
88E4'@

iṏqHɰ
#箌ZCt
`E=@O

ṿiqx
#ć11z j]r
H
4=DU$|lZCK 
`E)@01

ṿiqD
#bKʈ`1;t<F##I*{00fZC5
88E45@z

iṏqr
#ZC5
`E@^0

ṿiq
#$7a&q[QF/ޡ#Cmr>ZCo
88E4E@x

iṏq&
#ZC
88E4)@̔

iṏqx
#ZC&
,,E(=@!

ṿiqxPZC$
88E4\@a

iṏq
#ZC4
,,E(_@%

ṿiqP4ZC
88E4.d@0Z

iṏq܀M
#ZC
,,E(@

ṿiqPh
[-- Attachment #3 --]
ò`ZCDDE@@

ṿipџO
ZCDDE@t@A>

iṏpѠQ
#ZCy88E4<@!

ṿipѠ
'#ZCR`8E4%@5

ṿipѠG-
(#
$e!q-OǕ>4	K)y&2z4CCyؘQZC+6`E@9

ṿipՠU
(#aifd6(jB*}ms&Ύ#PZCD688E4.@0

iṏpl
#(ZCL`EX@!

ṿiplj
(#K,b/uY.{Ӓ0(<`.}r ݞnZCHL88E41@S

iṏp8
#(ZC-`E@l

ṿip8
V#Cţؾ7tDZ/cCFd@1tZC`E<@r

ṿipE
V#SEM)y/,r=5u%yW<w.K0ZC88E4X@e

iṏpЀJ
#VZC`E@7

ṿipЏF
[#3ô[V2D~Ԛo{p|ͩnb~ZCQ88E4@@}

iṏp휀
#[ZC`E@

ṿip휏
[#fC+Kb%$~μ0'tKB'ZC+`E@\

ṿiph
#̆BJxVٻ8I-4I(gZC;88E4@K

iṏp4
#<[ZC `E6@#^

ṿip4ѐ
#wr;,MA(e+/z<`TZC\88E4B8@

iṏpV
#BZC`E~@

ṿipa]
#8VUFBxs8pԿն%aZC0`E@S

ṿiq̏H=
#<E儡lAʱeVsz
y#[z1ђZC088E41@

iṏqx
#eZCF`E@4

ṿiqg
#<p^WnW!lj*fڔ?5%=͵XCZCF88E4@Ħ

iṏq
dq
#kZC"\`Eȓ@^

ṿiq
dW
#B@jdOyeŠ}G^E*ZCq`E@:o

ṿiq0>
#BTZqτ
)y!	ԺY)϶흓ms}-ZCq88E4fR@k

iṏqj^
#vZC`E@w

ṿiq
#eܛG|+A!{{ߜWFXOZC88E4DG@w

iṏqȀb
#ZC`E@%

ṿiqȏ/
#e
\2nx]Di Dl_4f:O#dZC`E@Tn

ṿiq-
#k/YS8ى՞ Nv5_ڏZC88E4@

iṏq"`[
#ZC`Ej@

ṿiq"`?
#vui=3C6GEFNjƷ.ZC88E4r,@

iṏq',Ti
#ZC*`E@?

ṿiq',
#vúI!{:'%i<,bμ:fWddqsZC|`E9@ 

ṿiq+*
#$-?ep/NEBL
3QO[πDZC|88E4@@[~

iṏq0ĀM
#ZC2`EY@k

ṿiq0ď
#_A樬\EyMX챛Kc4]]Pge'#ZCh88E4$f@:X

iṏq5E
#ZC`E@J5

ṿiq5
#hGs%^|)Yܚ`|*[HFZC`E6@#S

ṿiq:\<
#N7 ?_ʎ4ϸ	~FK"_ZC88E4@à

iṏq?(>
#ZC`E@@R

ṿiq?(b
,#޷wxdP@
)v#D/cjO(	ZCU88E4m]@`

iṏqC7
#,ZC2`E@Q

ṿiqC#
,#F,$luSk3
QQ`閅%_jZCH`E@Ti

ṿiqH=
5#÷p_8ԜHn\m7J+S݋ImkYZCH88E4\f@X

iṏqM/
#,ZC5j`E@g

ṿiqM>
@#]~I19`RZ#MX?:9/ZC^j88E4MO@o

iṏqRX(
#@ZC+`E@Dc

ṿiqRX,i
@#n|?`.Zp%5И:5`RgZC)`EX@

ṿiqW$

U#/
{eJl?~Lbdg
ZC:88E4
B@Q|

iṏq[!F
#
@ZC`E@G

ṿiq[&	
`#;L8㙑#sc&<g2pI
gwd`))"ZC88E4"@Λ

iṏq`
#`ZC`E@'

ṿiq`
a#xd%55QwJwR=,u뭆xtZC`E@`

ṿiqe)
i#44"l+uK
MyP^Ψa+U{Y-ZC88E4E-@

iṏqjT
#"aZC1_`E@m.

ṿiqjT
~#
RbZ]BNt OuuRw^2K;GZC[_88E4V@g

iṏqo I
#6~ZC%u`E\@

ṿiqo z
#
zcZʗ=ie:e
:DUMOSQ̾>ZC`E2@'l

ṿiqs쏮P
#錗E0~sRQR՜;ēN"K1֘ՁZC88E4B5@

iṏqx
#AZC`E@

ṿiqx|
#"thʪ[j"SG ⏭EQ27WZCI88E4!H@=v

iṏq}
#LZC`E@

ṿiq}
#"ͤѰ#yV04pw`/ѡ7ðw~qZC`E@?

ṿiqPt
#"m?Lye^eC,կt./~(ZC88E4s@

iṏqz
#WZC*	`E@

ṿiqS
#A/K1muVuO4R=Nrq_WY!}ZC*	88E4(@

iṏq
#jZC@	`E@FX

ṿiq菮+
#A΃ȀvV(?DNh4eC!ZCV	`E{@_

ṿiqfo
#A'rW-yGFJȠQ񛺥huZC0V	88E4z@~C

iṏq
#uZCl	`E@a

ṿiq:
#L7n}2Q1+e֟5T(7ZCFl	88E4@

iṏqLߗ
#{ZC	`E@

ṿiqLȫ
#WQS?! bKJ;TqU!Y,w7z2w]!ZC	`E@g

ṿiqȄ
#WMt
fS|`q7"ABPĉuZC	88E4S@j

iṏqO
#ZC	`E@

ṿiq䏮
#j[\لf,*jqXe`BP]][ZC	88E4@

iṏq
#ZC0	`Ḛ@A

ṿiq#T
#u|CJ"?l/V^8R@E@P3^W%
1rZC
`E#@6

ṿiq|v
#u(|PJa{f9R.1o^Pu#	-ZC
88E4'@

iṏqHɰ
#ZC!
`E'@2

ṿiqHF
#{<c|<qԢ|&!d@b1yZC!
88E45@z

iṏqr
#ZCD
`E@D

ṿiqk
#L.5Y
zj	ɡ<`,S<7YOa?ZZCZ
`E؆@k

ṿiq
#P
)9l1ډ%Qe"H	:S"R	ZCZ
88E4E@x

iṏq&
#ZC0p
`Eu@1

ṿiq
#$9V"EĿJؒ4
h#IC?٫ZCgp
88E4)@̔

iṏqx
#ZC
`E=@O

ṿiqx
#ć11z j]r
H
4=DU$|lZC2
`E)@01

ṿiqD
#bKʈ`1;t<F##I*{00fZCC
88E4\@a

iṏq
#ZC-
`E@^0

ṿiq
#$7a&q[QF/ޡ#Cmr>ZCk
88E4.d@0Z

iṏq܀M
#ZC
,,E(=@!

ṿiqxPZC&/,,E(_@%

ṿiqP4ZCG,,E(@

ṿiqPh

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?435AA8BA.6020808>