Re: NAT stops forwarding ACKs after PMTU discovery

Phil Oester
2013-08-19T14:35:09Z

On Mon, Aug 19, 2013 at 06:58:05AM -0700, Eric Dumazet wrote:
> Yeah, but here, this is conntrack who is blocking the thing.
>
> TCP receiver has no chance to 'fix' it.
>
> See conntrack is one of those buggy middle box as well.
>
> So if you want to properly handle this mess, you'll also have to fix
> conntrack.

Better to fix the box which is randomizing the acks and ignoring
the SACKs. Usually these are older Cisco PIX/ASA devices which just
need a code upgrade.

Phil