netdev - Re: Miscalculated TCP ACK ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1314031128.2307.110.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC>
Date:	Mon, 22 Aug 2011 18:38:48 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Gabriel Beddingfield <gabrbedd@...il.com>
Cc:	netdev@...r.kernel.org
Subject: Re: Miscalculated TCP ACK ?

Le lundi 22 août 2011 à 10:34 -0500, Gabriel Beddingfield a écrit :
> I'm having trouble with a particular server via HTTPS.  It appears
> that my local linux machines are sending incorrect ACK.  However, I
> don't have enough expertise to know for sure.
> 
> Using wireshark, the server sends:
> 
>     Transmission Control Protocol, Src Port: https (443), Dst Port:
> 36015 (36015), Seq: 27658, Ack: 827, Len: 18
> 
> Local machine replies:
> 
>     Transmission Control Protocol, Src Port: 36015 (36015), Dst Port:
> https (443), Seq: 827, Ack: 27677, Len: 0
> 
> It appears to me that the ACK is off-by-one (should have been 27676).
> The server replies again with retransmissions.  This is with several
> kernel versions on local machines, ranging from 2.6.31 to 2.6.38.
> 
> Can anyone shed insight into what's happening?  This looks like a bug to me.

Not a bug if frame carried a FIN

18:32:16.177801 IP 10.150.51.213.52264 > 10.150.45.194.22: Flags [F.], seq 3312, ack 3241, win 412, length 0
18:32:16.178096 IP 10.150.45.194.22 > 10.150.51.213.52264: Flags [F.], seq 3241, ack 3313, win 203, length 0
18:32:16.256949 IP 10.150.51.213.52264 > 10.150.45.194.22: Flags [.], ack 3242, win 412, length 0


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html