linux-kernel - net: tcp retransmissions happens to fast

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 06 Aug 2013 13:15:57 +0200
From:	"Dawid Stawiarski" <neeo@...wp.pl>
To:	linux-kernel@...r.kernel.org
Subject: net: tcp retransmissions happens to fast

Hi,

during tracking problem with NFS shares, we've found something weard happening to TCP connection.
We're using Ubuntu 12.04 with kernel 3.8.0-27-generic. We've managed to capture network traffic on client side, when the problem starts. After sending the pcap to linux-nfs group, we were sugested to send here (the thead on linux-nfs: http://thread.gmane.org/gmane.linux.nfs/57923 ).
Dump of traffic attached shows that:
0. operation SETATTR before problem starts works as charm (attached for reference)
1. retransmission happens very fast after sending 3 packets for WRITE operation
1a. linux is not using jumbo frame (3 packets of ~1K size instead of one)
2. linux ignores the ACK received after retransmission (actually it's cumulative ACK for the third packet)

netstats shows that data is in queue and the retransmissions are happening (however things start to work normally after NEW connection is established):
tcp        0 132902 10.254.39.74:719        10.254.38.115:2049      ESTABLISHED -                on (43.21/3/0)

cheers,
Dawid

Download attachment "n28-part.pcap" of type "application/vnd.tcpdump.pcap" (6938 bytes)