Re: NAT stops forwarding ACKs after PMTU discovery

Eric Dumazet
2013-08-19T15:32:16Z

On Mon, 2013-08-19 at 07:35 -0700, Phil Oester wrote:
> On Mon, Aug 19, 2013 at 06:58:05AM -0700, Eric Dumazet wrote:
> > Yeah, but here, this is conntrack who is blocking the thing.
> >
> > TCP receiver has no chance to 'fix' it.
> >
> > See conntrack is one of those buggy middle box as well.
> >
> > So if you want to properly handle this mess, you'll also have to fix
> > conntrack.
>
> Better to fix the box which is randomizing the acks and ignoring
> the SACKs. Usually these are older Cisco PIX/ASA devices which just
> need a code upgrade.

Having a patch to relax things could be evaluated, if not adding new
problems ( http://en.wikipedia.org/wiki/Robustness_principle )