netdev - Re: After many hours all outbound connections get stuck in SYN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <83a51e120712210557s2f43c238i5139ae74753a0f17@mail.gmail.com>
Date:	Fri, 21 Dec 2007 08:57:25 -0500
From:	"James Nichols" <jamesnichols3@...il.com>
To:	"Glen Turner" <gdt@....id.au>
Cc:	"Jan Engelhardt" <jengelh@...putergmbh.de>,
	"Eric Dumazet" <dada1@...mosbay.com>, linux-kernel@...r.kernel.org,
	"Linux Netdev List" <netdev@...r.kernel.org>
Subject: Re: After many hours all outbound connections get stuck in SYN_SENT

> Huh?  Do you mean a PIX blade in a Cisco switch-router chassis? It
> would be very useful if you could be less vague about the
> equipment in use.

Right it's a PIX blade in Cisco chassis.  The PIX is running ASA version 7.0(6)



> That depends more on your customers' networking attributes
> then you are sharing or perhaps even know.  Perhaps your customer
> base is very Window-skewed and you simply aren't seeing any Sack
> Permitted negotiations for the first 37.999 hours. Or
> perhaps you've had a network glitch, and all of your
> connections have done a Selective Ack, which the firewall
> has trashed, leaving all the connections in a wacko state,
> not just a few which you haven't noticed.

I definitely see SACKs over the course of the 38 hours.  I don't have
any Windows hosts, they are all running Linux except for a very small
number that run a proprietary OS and webserver.  If the firewall were
to get trashed and hose the currently active connections, I would
expect that newly initiated connections would work.


> The actual failure mode needs a packet trace to determine,
> but you should be able to do this yourself (or ask your
> local network engineering staff).
>
> If your firewall is trashing the Sack field, then it needs
> to be fixed.  Time to raise a case with the Cisco TAC and
> ask them directly if your PIX version has bug CSCse14419.
> You can't expect Sack to work when it's being fed trash,
> so it is important to make sure that is not happening.

I've pinged our dude that handles the PIX stuff to see about getting
an upgrade to 7.0(7).  I should be able to get a packet trace, but it
may take some time.  At this point I'm getting a lot of resistance and
people here telling me to just turn SACK off and not worry about what
is causing this issue, but I'd really like to get to the bottom of it.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html