netdev - Re: After many hours all outbound connections get stuck in SYN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0712210701470.21721@fbirervta.pbzchgretzou.qr>
Date:	Fri, 21 Dec 2007 07:06:13 +0100 (CET)
From:	Jan Engelhardt <jengelh@...putergmbh.de>
To:	Ilpo Järvinen <ilpo.jarvinen@...sinki.fi>
cc:	James Nichols <jamesnichols3@...il.com>,
	Glen Turner <gdt@....id.au>,
	Eric Dumazet <dada1@...mosbay.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Linux Netdev List <netdev@...r.kernel.org>
Subject: Re: After many hours all outbound connections get stuck in SYN_SENT


On Dec 20 2007 23:05, Ilpo Järvinen wrote:
>> 
>> Given the fact that I've had this problem for so long, over a variety
>> of networking hardware vendors and colo-facilities, this really sounds
>> good to me.  It will be challenging for me to justify a kernel core
>> dump, but a simple patch to dump the Sack data would be do-able.
>
>If your symptoms really are: SYNs leaving (if they show up in tcpdump, for 
>sure they've left TCP code already) and SYN-ACK not showing up even in 
>something as early as in tcpdump (for sure TCP side code didn't execute at 
>that point yet), there's very little change that Linux' TCP code has some 
>bug in it, only things that do something in such scenario are the SYN 
>generation and retransmitting SYNs (and those are trivially verifiable 
>from tcpdump).
>
Take a machine, put two interfaces in it, configure as bridge (br0
over eth0 and eth1 without any assigned ip addresses), put it between
end node and the cisco. tcpdump there, which should give an unbiased
view wrt. endnode/cisco. Then perhaps, also configure such a network
listening bridge on the other side of the cisco, e.g. on the link to
the internet and watch that. Compare the two tcpdumpds and see if
sack got trashed.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html