From owner-freebsd-hackers  Sat Dec 21 17:40:16 1996
Return-Path: <owner-hackers>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.4/8.8.4) id RAA12637
          for hackers-outgoing; Sat, 21 Dec 1996 17:40:16 -0800 (PST)
Received: from scanner.worldgate.com (scanner.worldgate.com [198.161.84.3])
          by freefall.freebsd.org (8.8.4/8.8.4) with ESMTP id RAA12632
          for <hackers@freebsd.org>; Sat, 21 Dec 1996 17:40:13 -0800 (PST)
Received: from znep.com (uucp@localhost) by scanner.worldgate.com (8.7.5/8.7.3) with UUCP id SAA02152; Sat, 21 Dec 1996 18:40:11 -0700 (MST)
Received: from localhost (marcs@localhost) by alive.ampr.ab.ca (8.7.5/8.7.3) with SMTP id SAA08684; Sat, 21 Dec 1996 18:40:03 -0700 (MST)
Date: Sat, 21 Dec 1996 18:40:02 -0700 (MST)
From: Marc Slemko <marcs@znep.com>
X-Sender: marcs@alive.ampr.ab.ca
To: Bill Fenner <fenner@parc.xerox.com>
cc: hackers@freebsd.org
Subject: Re: TCP FIN/ACK storm oddity 
In-Reply-To: <96Dec15.223727pst.177711@crevenia.parc.xerox.com>
Message-ID: <Pine.BSF.3.95.961221182728.6958H-100000@alive.ampr.ab.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-hackers@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

On Sun, 15 Dec 1996, Bill Fenner wrote:

> Sounds like what Peter Wemm saw in PR kern/1940.

Hmm.  Perhaps related somehow.

> 
> Can you replicate the exchange from the second message, but use "tcpdump -S"
> so that tcpdump doesn't try to be smart about the sequence numbers?  A
> "tcpdump -w" might be even better.
> 
>   Bill
> 

The same exchange as in my previous message, but with -S:

03:49:01.543188 futurity.worldgate.com.telnet > darkly.worldgate.com.1701: F 541865:541865(0) ack 1325056048 win 2048
03:49:01.543392 darkly.worldgate.com.1701 > futurity.worldgate.com.telnet: F 1325056048:1325056048(0) ack 541866 win 17153 (DF) [tos 0x10]
03:49:01.544394 futurity.worldgate.com.telnet > darkly.worldgate.com.1701: . ack 1325056048 win 2048
03:49:01.544596 darkly.worldgate.com.1701 > futurity.worldgate.com.telnet: F 1325056048:1325056048(0) ack 541866 win 17153 (DF) [tos 0x10]
03:49:01.545666 futurity.worldgate.com.telnet > darkly.worldgate.com.1701: . ack 1325056048 win 2048
03:49:01.545877 darkly.worldgate.com.1701 > futurity.worldgate.com.telnet: F 1325056048:1325056048(0) ack 541866 win 17153 (DF) [tos 0x10]
03:49:01.547046 futurity.worldgate.com.telnet > darkly.worldgate.com.1701: . ack 1325056048 win 2048

When I try the same thing between a box running Solaris 2.5 and
the Ascend, I get a somewhat similar situation except that the
packets are _far_ less frequent.  The test with Solaris was over
a link with a much higher RTT (~90ms) which may or may not account
for the difference.  I let the Solaris box and the Ascend go on
talking for days, and it simply wouldn't stop on its own.

The raw log of the connection shown above was written to disk with
-w, which is where I generated the above output from.  I can make
the raw log (~15 megs) available to anyone who wants to take a
look.

I am hoping to get the time to go through the connection step by step
and state by state within the next few weeks.