Out-of-Window RST Problem?

Out-of-Window RST Problem?

[Tim Burress]

Hello,

We're using 2.4.30 with TCP window tracking on a box that acts as a 
router, and have been seeing situations where some client systems, 
notably some incarnation of Windows XP SP2 with IE 6.0, are sending RST 
segments with what appear to be incorrect ack sequence numbers. These 
are dropped as out-of-window by Netfilter, with the result that 
connections hang and everybody gets upset. Here is the relevant snippet 
of an example session:

1    16:17:06.441369 IP server.1935 > client.48415: P 3465:3931(466) ack 
3641 win 11680
2    16:17:06.597107 IP client.48415 > server.1935: . ack 3931 win 64525
3    16:17:10.034881 IP client.48415 > server.1935: P 3641:3683(42) ack 
3931 win 64525
4    16:17:10.035085 IP client.48415 > server.1935: R 3684:3684(0) ack 
3932 win 1024
5    16:17:10.073142 IP server.1935 > client.48415: . ack 3683 win 11680

So, you can see on line 4 that the ack sequence number in the RST sent 
by the client (caused by a "Stop" click in the browser) has inexplicably 
been incremented from the previous value. For that matter, so has the 
send sequence number, though at least it's in the server's window.

It seems obvious that it's a Microsoft issue of some kind, so I really 
should try talking to them (if they do, in fact, talk to people), but I 
thought I would ask about it here first because (1) the standards are a 
little obscure about unprovoked ("lazy close") RST handling and I may be 
wrong in blaming Microsoft, and (2) given the apparent popularity of XP 
it seems like it might be something of interest to this group, and of 
course (3), I wondered if anyone have seen it before and perhaps knows 
of a fix.

I should say that we have not been able to reproduce this locally, so 
there may well be other factors involved besides the combination of OS 
and browser. Perhaps some update that has not been applied. 
Unfortunately we don't have access to the client system, or even direct 
communication with its owner.

Tim

Re: Out-of-Window RST Problem?

[Roberto Nibali]

Hi,

> We're using 2.4.30 with TCP window tracking on a box that acts as a
> router, and have been seeing situations where some client systems,
> notably some incarnation of Windows XP SP2 with IE 6.0, are sending RST
> segments with what appear to be incorrect ack sequence numbers. These
> are dropped as out-of-window by Netfilter, with the result that
> connections hang and everybody gets upset. Here is the relevant snippet
> of an example session:
> 
> 1    16:17:06.441369 IP server.1935 > client.48415: P 3465:3931(466) ack
> 3641 win 11680
> 2    16:17:06.597107 IP client.48415 > server.1935: . ack 3931 win 64525
> 3    16:17:10.034881 IP client.48415 > server.1935: P 3641:3683(42) ack
> 3931 win 64525
> 4    16:17:10.035085 IP client.48415 > server.1935: R 3684:3684(0) ack
> 3932 win 1024
> 5    16:17:10.073142 IP server.1935 > client.48415: . ack 3683 win 11680
> 
> So, you can see on line 4 that the ack sequence number in the RST sent
> by the client (caused by a "Stop" click in the browser) has inexplicably
> been incremented from the previous value. For that matter, so has the
> send sequence number, though at least it's in the server's window.

I have similar traces from the wild open world.

> I should say that we have not been able to reproduce this locally, so
> there may well be other factors involved besides the combination of OS
> and browser. Perhaps some update that has not been applied.
> Unfortunately we don't have access to the client system, or even direct
> communication with its owner.

Exactly our problem. It's completely impossible to reproduce it locally, we
don't get access to the customer's broken application, we don't know how to
write such an application and we are only allowed to debug the packet filter
during agreed service windows (through strict SLAs), which we need to upgrade
the rest of the environment.

I'll try to dig up some of the traces since Jozsef Kadlecsik kindly offered to
review the 2.4.x implementation of the tcp window tracking patch.

Cheers,
Roberto Nibali, ratz
-- 
-------------------------------------------------------------
addr://Rathausgasse 31, CH-5001 Aarau  tel://++41 62 823 9355
http://www.terreactive.com             fax://++41 62 823 9356
-------------------------------------------------------------
terreActive AG                       Wir sichern Ihren Erfolg
-------------------------------------------------------------