Re: Disabling "TCP Treason uncloaked"

[Just Marc <marc@corky.net>]

Hi,
> Just Marc <marc@corky.net> wrote:
>   
>> We're now at 2.6.16.12 and it is still showing thousands of times a day 
>> on a busy web server, have all the bugs been discovered yet?
>>     
>
> There are no known bugs on the RX side in 2.6.16 that would cause this.
> The few busy web servers that I have access to do not see this message
> at all.
>
> So either your web server is somehow attracting a lot of buggy TCP stacks,
> or there could be a dodgy gateway in your path that is mucking with the
> TCP windows.
>
>   
You're right, actually this box serves http/ftp file transfers only, 
it's a mirror with a large amount of downloads a day.

On a pure html/image web server that is just as busy, there are only a 
few of these messages, one or two a day.
> I suggest that you do a tcpdump to see what it looks like.  It might turn
> out that we do still have a bug on our RX side.
>   
I gave it another look, many of the prints are repeat prints for the 
same remote IPs,
> BTW, this message is already under net_ratelimit so I don't see any
> urgency in getting rid of it completely.  If we're going down the
> path of disabling it, we probably should go for something more global
> rather than a sysctl that controls this one message.
>   
I agree, however, I think it's pretty good to allow an admin to toggle 
it off completely.  Maybe that's all we need, really.

Thanks