From: Phil Oester <kernel@linuxace.com>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Christoph Paasch <christoph.paasch@uclouvain.be>,
Corey Hickey <bugfood-ml@fatooh.org>,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
Linux Netdev List <netdev@vger.kernel.org>,
netfilter-devel@vger.kernel.org
Subject: Re: NAT stops forwarding ACKs after PMTU discovery
Date: Mon, 19 Aug 2013 07:35:09 -0700 [thread overview]
Message-ID: <20130819143509.GA31320@linuxace.com> (raw)
In-Reply-To: <1376920685.4226.61.camel@edumazet-glaptop>
On Mon, Aug 19, 2013 at 06:58:05AM -0700, Eric Dumazet wrote:
> Yeah, but here, this is conntrack who is blocking the thing.
>
> TCP receiver has no chance to 'fix' it.
>
> See conntrack is one of those buggy middle box as well.
>
> So if you want to properly handle this mess, you'll also have to fix
> conntrack.
Better to fix the box which is randomizing the acks and ignoring
the SACKs. Usually these are older Cisco PIX/ASA devices which just
need a code upgrade.
Phil
next prev parent reply other threads:[~2013-08-19 14:34 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-18 5:55 NAT stops forwarding ACKs after PMTU discovery Corey Hickey
2013-08-18 15:24 ` Eric Dumazet
2013-08-18 16:59 ` Corey Hickey
2013-08-18 21:23 ` Jozsef Kadlecsik
2013-08-19 0:00 ` Eric Dumazet
2013-08-19 0:03 ` Eric Dumazet
2013-08-19 8:43 ` Corey Hickey
2013-08-19 12:33 ` Christoph Paasch
2013-08-19 13:24 ` Eric Dumazet
2013-08-19 13:49 ` Christoph Paasch
2013-08-19 13:58 ` Eric Dumazet
2013-08-19 14:35 ` Phil Oester [this message]
2013-08-19 15:32 ` Eric Dumazet
2013-08-19 15:33 ` Christoph Paasch
2013-08-19 16:00 ` Eric Dumazet
2013-08-19 17:15 ` Christoph Paasch
2013-08-19 18:00 ` Phil Oester
2013-08-19 18:10 ` Eric Dumazet
2013-08-19 19:29 ` [RFC 0/2] Account for duplicate ACKs with invalid SACK-blocks Christoph Paasch
2013-08-19 19:29 ` [RFC 1/2] Use acked_out for reno-style ack acounting instead of sacked_out Christoph Paasch
2013-08-19 19:29 ` [RFC 2/2] Account acked_out in sack, if the sack is invalid Christoph Paasch
2013-08-19 21:22 ` [RFC 0/2] Account for duplicate ACKs with invalid SACK-blocks Corey Hickey
2013-08-20 7:36 ` Christoph Paasch
2013-08-22 3:32 ` David Miller
2013-08-22 4:15 ` Corey Hickey
2013-08-19 14:43 ` NAT stops forwarding ACKs after PMTU discovery Christoph Paasch
2013-08-19 20:13 ` Jozsef Kadlecsik
2013-08-19 20:43 ` Christoph Paasch
2013-08-19 21:08 ` Eric Dumazet
2013-08-19 22:07 ` Jozsef Kadlecsik
2013-08-20 4:18 ` Corey Hickey
2013-08-19 18:22 ` Corey Hickey
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130819143509.GA31320@linuxace.com \
--to=kernel@linuxace.com \
--cc=bugfood-ml@fatooh.org \
--cc=christoph.paasch@uclouvain.be \
--cc=eric.dumazet@gmail.com \
--cc=kadlec@blackhole.kfki.hu \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.