Re: [Fwd: Re: Networking messed up, bad checksum, incorrect length]

[Carlos Velasco <lkml@newipnet.com>]

Jozsef Kadlecsik escribió:
> On Mon, 30 Oct 2006, Jozsef Kadlecsik wrote:
> 
>> On Mon, 30 Oct 2006, Carlos Velasco wrote:
>>
>>> I'm forwarding a mail from Linux Kernel, as it seems a bug in Netfilter
>>> in 2.6.18.
>> The TCP session dies because a NAT device between the communicating 
>> parties does not adjust the sequence numbers in the SACK fields.
>>
>> Is there a NATing device, which is not identical with the machine running 
>> 2.6.28, between the client and the server?
> 
> No, it's not a NATing device. It's a 'smart' box which munges the TCP 
> sequence numbers and misses to do so in the SACK fields: the first packet 
> from both recordings:

Yes, you are absolutely right. This is not a linux/netfilter issue.

After a little research we saw a Cisco PIX firewall behind the receiver
SMTP server doing ISN randomization.

I contacted Cisco and a bug has been raised for this issue:
Bug number: CSCse14419
http://www.cisco.com/cgi-bin/bugtool/onebug.pl?bugid=CSCse14419

As a workaround, ISN randomization can be disabled for TCP connections,
like this:

===
access-list WAROUNDTCP extended permit tcp any any

class-map WAROUNDTCP
 match access-list WAROUNDTCP

policy-map global_policy
 class WAROUNDTCP
  set connection random-sequence-number disable
===

I thought it's a good thing to post this email for future refence if
this issue comes back again in the future.

Regards,
Carlos Velasco