Send SYN ACK from server ?

Send SYN ACK from server ?

[Michael Gale]

Hello,

    I am seeing a problem where when a linux box from behind a linux 
firewall connects to an external server, the external server is sending 
a second SYN,ACK message:

-> SYN sent
<- SYN,ACK received -- WINDOWS SIZE SET TO 0 ??
-> ACK sent

Then the external server sends:
<-SYN, ACK with same seq numbers ?? and WINDOW SIZE SET TO 16560 ??

Now if the client is windows :( it replies to the second SYN,ACK and 
everything seems to work, however when the client is linux, the second 
SYN,ACK is ignored by the client which I believe causes the connection 
state to be destroyed on the firewall.

Am I corrent is assuming that the window size update packet should NOT 
have the SYN bit set and that this is a problem on the remote server ?

Michael

-- 
Michael Gale

Linux Administrator
Network Administrator
Pason Systems Corp.

Re: Send SYN ACK from server ?

[Michael Gale]

Hello,

    Why does disabling TCP window tracking resolve this issue ?

The firewall is CentOS 4 - kernel Linux fw1-calgary.int.pason.com 
2.6.9-22.0.1.EL #1 Thu Oct 27 12:26:11
iptables 1.2.11

# echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal


Michael

Michael Gale wrote:

> Hello,
>
>    I am seeing a problem where when a linux box from behind a linux 
> firewall connects to an external server, the external server is 
> sending a second SYN,ACK message:
>
> -> SYN sent
> <- SYN,ACK received -- WINDOWS SIZE SET TO 0 ??
> -> ACK sent
>
> Then the external server sends:
> <-SYN, ACK with same seq numbers ?? and WINDOW SIZE SET TO 16560 ??
>
> Now if the client is windows :( it replies to the second SYN,ACK and 
> everything seems to work, however when the client is linux, the second 
> SYN,ACK is ignored by the client which I believe causes the connection 
> state to be destroyed on the firewall.
>
> Am I corrent is assuming that the window size update packet should NOT 
> have the SYN bit set and that this is a problem on the remote server ?
>
> Michael
>

-- 
Michael Gale

Linux Administrator
Network Administrator
Pason Systems Corp.