netdev - Re: TCP connection closed without FIN or RST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 3 Nov 2017 10:02:53 -0400
From:   Vitaly Davidovich <vitalyd@...il.com>
To:     Eric Dumazet <eric.dumazet@...il.com>
Cc:     netdev <netdev@...r.kernel.org>
Subject: Re: TCP connection closed without FIN or RST

On Fri, Nov 3, 2017 at 9:39 AM, Vitaly Davidovich <vitalyd@...il.com> wrote:
> On Fri, Nov 3, 2017 at 9:02 AM, Eric Dumazet <eric.dumazet@...il.com> wrote:
>> On Fri, 2017-11-03 at 06:00 -0700, Eric Dumazet wrote:
>>> On Fri, 2017-11-03 at 08:41 -0400, Vitaly Davidovich wrote:
>>> > Hi Eric,
>>> >
>>> > Ran a few more tests yesterday with packet captures, including a
>>> > capture on the client.  It turns out that the client stops ack'ing
>>> > entirely at some point in the conversation - the last advertised
>>> > client window is not even close to zero (it's actually ~348K).  So
>>> > there's complete radio silence from the client for some reason, even
>>> > though it does send back ACKs early on in the conversation.  So yes,
>>> > as far as the server is concerned, the client is completely gone and
>>> > tcp_retries2 rightfully breaches eventually once the server retrans go
>>> > unanswered long (and for sufficient times) enough.
>>> >
>>> > What's odd though is the packet capture on the client shows the server
>>> > retrans packets arriving, so it's not like the segments don't reach
>>> > the client.  I'll keep investigating, but if you (or anyone else
>>> > reading this) knows of circumstances that might cause this, I'd
>>> > appreciate any tips on where/what to look at.
>>>
>>>
>>> Might be a middle box issue ?  Like a firewall connection tracking
>>> having some kind of timeout if nothing is sent on one direction ?
>>>
>>> What output do you have from client side with :
>>>
>>> ss -temoi dst <server_ip>
>>
>> It also could be a wrapping issue on TCP timestamps.
>>
>> You could try disabling tcp timestamps, and restart the TCP flow.
>>
>> echo 0 >/proc/sys/net/ipv4/tcp_timestamps
> Ok, I will try to do that.  Thanks for the tip.
Tried with tcp_timestamps disabled on the client (didn't touch the
server), but that didn't change the outcome - same issue at the end.
>>
>>
>>
>>
>>