Date: Sun, 14 Nov 2021 18:41:16 +0100 From: Kurt Jaeger <pi@freebsd.org> To: "Andrey V. Elsukov" <bu7cher@yandex.ru> Cc: tuexen@freebsd.org, freebsd-net@freebsd.org Subject: Re: dtrace to trace incoming connection not suceeding ? Message-ID: <YZFKPIEROC1cwcOQ@fc.opsec.eu> In-Reply-To: <eec5880e-3164-f0a2-3748-687098de3026@yandex.ru> References: <YY5nhomjYRnRojwa-v2@fc.opsec.eu> <866D4765-25EF-4C5F-AA2E-D6BE8D5EBEEB@freebsd.org> <YY6C2/OyG3KTvV%2BM@fc.opsec.eu> <43FC040E-E5DE-4F4E-B91E-AAA807207D05@freebsd.org> <YY6ITiq%2B8x5nw5a/@fc.opsec.eu> <36CCF1D0-34EE-4E1C-B593-71CF936F4DE7@freebsd.org> <YY6k1JzP4EbKCF7m@fc.opsec.eu> <eec5880e-3164-f0a2-3748-687098de3026@yandex.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi! > > There's one small diff between the two that I do not understand: > > > > - 18040 times no signature provided by segment > > + 18045 times no signature provided by segment > > This means, that received TCP segment has not TCP-MD5 signature, but > listen socket expects it. Such SYN segment will be dropped by syncache > code. Probably your BGP daemon configured to use TCP-MD5 for connection, > but remote side does not. Thanks, that might be another possible cause. This happened on iBGP sessions where I control both sides or on eBGP sessions, where I also control both sides (and both run on FreeBSD). I did not change the frr config during updates, so I did not expect this to break. Maybe frr on newer FreeBSD versions handles the tcp-md5 case in some invalid way. That might be the case and this probably needs to be analysed. -- pi@FreeBSD.org +49 171 3101372 Now what ?
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?YZFKPIEROC1cwcOQ>