Date: Tue, 16 Sep 1997 16:35:25 +0200 From: j@ida.interface-business.de (J Wunsch) To: freebsd-hackers@freebsd.org (FreeBSD hackers) Subject: Any TCP expert around? Message-ID: <19970916163525.KH02502@ida.interface-business.de>
next in thread | raw e-mail | index | archive | help
Whenever one of our FreeBSD machines contacts icon-gw.icon.de, the TCP connections breaks off in an endless flood of FIN-ack packets. Sorry for the messy data below, but it's hard to cut something off without losing information. That's a pretty normal HTTP connection, but towards the end, 193.102.86.65 doesn't seem to confirm the FIN flag, thus 193.101.57.200 remains in FIN_WAIT_1, and tries to resend the FIN flag over and over again, 7 minutes long. 193.101.57.200 is FreeBSD 2.2-something, running a plain FreeBSD TCP stack. 193.102.86.65 is supposedly running on a Sun, and for sure is using a Firewall-1. Using a Win95 client doesn't show this behaviour, only three or four FIN-ack pairs are flowing (and in much slower sequence), then the connection closes normally. What makes me a little nervous is the couple of packets sent by the FreeBSD side at 15:39.54.132386 and 15:39:54.133176. Why are there two packets? Whom to blame? 15:25:18.841146 193.101.57.200.4315 > 193.102.86.65.80: S 1036553716:1036553716(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp[|tcp]> (DF) 15:25:18.968586 193.102.86.65.80 > 193.101.57.200.4315: S 2661360185:2661360185(0) ack 1036553717 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp[|tcp]> (DF) 15:25:18.969441 193.101.57.200.4315 > 193.102.86.65.80: . ack 1 win 17280 <nop,nop,timestamp 3640510 3640510,nop,nop,eol,[|tcp]> (DF) 15:25:18.971094 193.101.57.200.4315 > 193.102.86.65.80: P 1:302(301) ack 1 win 17280 <nop,nop,timestamp 3640510 3640510,nop,nop,eol,[|tcp]> (DF) 15:25:19.076801 193.102.86.65.80 > 193.101.57.200.4315: S 124354575:124354575(0) ack 1036553717 win 9112 <mss 536> (DF) 15:25:19.077605 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3640510 3640510,nop,nop,[|tcp]> (DF) 15:25:19.421201 193.102.86.65.80 > 193.101.57.200.4315: P 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:25:19.422060 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3640511 3640510,nop,nop,[|tcp]> (DF) 15:25:22.232647 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:25:22.233438 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3640516 3640510,nop,nop,eol,[|tcp]> (DF) 15:25:27.865288 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:25:27.866084 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3640528 3640510,nop,nop,eol,[|tcp]> (DF) 15:25:28.200088 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:25:28.200881 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3640528 3640510,nop,nop,eol,[|tcp]> (DF) 15:25:39.142384 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:25:39.143176 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3640550 3640510,nop,nop,eol,[|tcp]> (DF) 15:26:01.614174 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:26:01.614970 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3640595 3640510,nop,nop,eol,[|tcp]> (DF) 15:26:46.615095 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:26:46.615889 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3640685 3640510,nop,nop,eol,[|tcp]> (DF) 15:27:42.930938 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:27:42.931799 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3640798 3640510,nop,nop,eol,[|tcp]> (DF) 15:28:39.125648 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:28:39.126675 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3640910 3640510,nop,nop,eol,[|tcp]> (DF) 15:29:35.367423 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:29:35.368217 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3641023 3640510,nop,nop,eol,[|tcp]> (DF) 15:30:31.616148 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:30:31.617006 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3641135 3640510,nop,nop,eol,[|tcp]> (DF) 15:31:27.871339 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:31:27.872302 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3641248 3640510,nop,nop,[|tcp]> (DF) 15:32:24.129971 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:32:24.130754 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3641361 3640510,nop,nop,[|tcp]> (DF) 15:33:20.377428 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:33:20.378275 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3641473 3640510,nop,nop,[|tcp]> (DF) 15:35:12.911454 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:35:12.912244 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3641698 3640510,nop,nop,[|tcp]> (DF) 15:37:05.431756 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:37:05.432548 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3641923 3640510,nop,nop,[|tcp]> (DF) 15:38:01.680078 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:38:01.680915 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3642036 3640510,nop,nop,[|tcp]> (DF) 15:38:57.950193 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:38:57.951151 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3642148 3640510,nop,nop,[|tcp]> (DF) 15:39:54.132386 193.102.86.65.80 > 193.101.57.200.4315: . 2537005611:2537006147(536) ack 302 win 9112 (DF) 15:39:54.133176 193.101.57.200.4315 > 193.102.86.65.80: . ack 2537005611 win 17280 <nop,nop,timestamp 3642261 3640510,nop,nop,[|tcp]> (DF) 15:40:19.392871 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 <nop,nop,timestamp 3642311 3640510,nop,nop,[|tcp]> (DF) 15:40:19.570522 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:40:19.571305 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 <nop,nop,timestamp 3642312 3640510,nop,nop,[|tcp]> (DF) 15:40:19.712133 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:40:19.712916 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 <nop,nop,timestamp 3642312 3640510,nop,nop,[|tcp]> (DF) 15:40:19.858971 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) ... 15:47:23.799609 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 <nop,nop,timestamp 3643161 3640510,nop,nop,[|tcp]> (DF) 15:47:23.805337 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:47:23.806153 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 <nop,nop,timestamp 3643161 3640510,nop,nop,nop,[|tcp]> (DF) 15:47:23.859484 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:47:23.860302 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 <nop,nop,timestamp 3643161 3640510,nop,nop,[|tcp]> (DF) 15:47:23.866083 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:47:23.866914 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 <nop,nop,timestamp 3643161 3640510,nop,nop,[|tcp]> (DF) 15:47:23.959676 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:47:23.960497 193.101.57.200.4315 > 193.102.86.65.80: F 302:302(0) ack 2537005611 win 17280 <nop,nop,timestamp 3643161 3640510,nop,nop,[|tcp]> (DF) 15:47:24.089870 193.102.86.65.80 > 193.101.57.246.1038: P 1282040329:1282040865(536) ack 174 win 9112 (DF) 15:47:24.095168 193.102.86.65.80 > 193.101.57.200.4315: R 2661360186:2661360186(0) win 0 (DF) 15:47:24.124285 193.102.86.65.80 > 193.101.57.200.4315: . ack 303 win 9112 (DF) 15:47:24.125056 193.101.57.200.4315 > 193.102.86.65.80: R 1036554019:1036554019(0) win 0 -- J"org Wunsch Unix support engineer joerg_wunsch@interface-business.de http://www.interface-business.de/~j
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19970916163525.KH02502>