From owner-freebsd-net@FreeBSD.ORG Tue Mar 16 04:18:34 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A1B4916A4CE; Tue, 16 Mar 2004 04:18:34 -0800 (PST) Received: from demos.su (mx.demos.su [194.87.0.32]) by mx1.FreeBSD.org (Postfix) with ESMTP id 766BC43D31; Tue, 16 Mar 2004 04:18:33 -0800 (PST) (envelope-from tolyar@mx.ru) Received: from [194.87.2.159] (HELO dwarf.demos.su) by demos.su (CommuniGate Pro SMTP 4.1.8/D) with SMTP id 179085393; Tue, 16 Mar 2004 15:18:32 +0300 Date: Tue, 16 Mar 2004 15:18:32 +0300 From: Zherdev Anatoly To: "Bjoern A. Zeeb" Message-Id: <20040316151832.3f8b9012@dwarf.demos.su> In-Reply-To: References: <20040316125335.5f64cac5@dwarf.demos.su> <20040316131256.015a082d@dwarf.demos.su> <4056D84C.514EC45C@freebsd.org> X-Mailer: Sylpheed version 0.9.9claws (GTK+ 1.2.10; i386-portbld-freebsd5.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit cc: freebsd-net@freebsd.org cc: Andre Oppermann Subject: Re: Problem with closing tcp session between cisco and freebsd X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Mar 2004 12:18:34 -0000 On Tue, 16 Mar 2004 11:29:45 +0000 (UTC) "Bjoern A. Zeeb" wrote: > > > FreeBSD 4.9-STABLE cvsupped March 3 > > > Cisco IOS 12.2.19a ip only Cisco 5300 > > > > Do you know when it was working correctly the last time? Do you have > > another machine (4.9R or lower, or 5.2 or 5.C) to test against? On > > March 2 the commit of the TCP segment reassembly queue limiter has > > been done but that does not change TCP processing otherwise in any > > way. A month ago the TCP-MD5 stuff has been committed. A year ago > > there have been some NewReno fixes. > > > > So no obvious suspect. Before digging deep into the code its better > > to have some more surrounding information. > > Another question: any packet filters in between ? Yes i have IPFW1 on this servers (it was the same problem on two servers at one time and one cisco) But in IPFW i have ACCEPT by default and only this deny rules: 00200 deny ip from any to 127.0.0.0/8 00300 deny ip from 127.0.0.0/8 to any 00400 deny log logamount 100 tcp from any to any 135-139,445,593 00500 deny log logamount 100 udp from any to any 135-139,445 01100 deny tcp from any to any 22 in recv fxp1 01600 reset tcp from any to any 113 I make ipfw flush when i see this situation and keep only 65535 allow ip from any to any but problem was not resolved and tcp session not ended. -- Zherdev Anatoly.