zero window probes on linux (fwd)

zero window probes on linux (fwd)

[Praveen Kumar Amritaluru]

Hi,

	I am running a  client-server  program with client  running on a
	linux machine with 2.4.18-14 kernel installed.

	When the server  announces  zero-window  to the  client,  client
	starts  sending   zero-window   probes  which  are  nothing  but
	unacceptable segments.

	A short trace  obtained  using  tcpdump  and  interpreted  using
	ethereal is shown below:


16:27:17.979349 e.f.g.h.33464 > a.b.c.d.40000: P Seq=76441951 Ack=802335667 Win 5840 len=1080
16:27:18.040407 a.b.c.d.40000 > e.f.g.h.33464: . Seq=802335667 Ack=764413031 Win 0 len=0
16:27:18.256213 e.f.g.h.33464 > a.b.c.d.40000: . Seq=764413030 Ack=802335667 Win 5840 len=0

	This sequence  continues as per  retransmission  algorithm  with
	same seq no.  and ack no on both ends of TCP connection.

	It can be seen above that unacceptable  zero-length packets with
	a  sequence  no.  already   unacknowledged   is  being  used  as
	zero-window probes.

	Zero  window  probes are defined in RFC 793 and  RFC1122 to be a
	data  segment  containing  atleast  one byte of data  beyond the
	window of the receiver who has closed the window.

	This  seems  to be a bug.  Has it been  already  fixed in  later
	kernel versions or is this how it is intended to remain?


Regards,

Praveen

Re: zero window probes on linux (fwd)

[Andi Kleen]

On Tue, 13 Apr 2004 15:43:29 +0530 (IST)
Praveen Kumar Amritaluru <praveen@india.hp.com> wrote:


> 
> 	This  seems  to be a bug.  Has it been  already  fixed in  later
> 	kernel versions or is this how it is intended to remain?

iirc this was intentional. The RFC suggested method doesn't work when talking to 
some stacks.

-Andi

Re: zero window probes on linux (fwd)

[Praveen Kumar Amritaluru]

> > 	This  seems  to be a bug.  Has it been  already  fixed in  later
> > 	kernel versions or is this how it is intended to remain?
> 
> iirc this was intentional. The RFC suggested method doesn't work when talking to 
> some stacks.
> 

	But  that  cannot  be  valid  enough   justification  for  doing
	something against RFC right?

	Is there anyone who is aware/confirm the  reason/history?  Is it
	the above reason mentioned by Andy?


> -Andi

Re: zero window probes on linux (fwd)

[Andi Kleen]

On Wed, 14 Apr 2004 14:27:09 +0530 (IST)
Praveen Kumar Amritaluru <praveen@india.hp.com> wrote:

> > > 	This  seems  to be a bug.  Has it been  already  fixed in  later
> > > 	kernel versions or is this how it is intended to remain?
> > 
> > iirc this was intentional. The RFC suggested method doesn't work when talking to 
> > some stacks.
> > 
> 
> 	But  that  cannot  be  valid  enough   justification  for  doing
> 	something against RFC right?

Of course it is. Welcome to the real world. RFC1122 has a lot of bugs and sometimes
does not describe really implemented practice (e.g. BSD set the defacto standard
in many behaviours and it does not always follow 1122) 

-Andi

Re: zero window probes on linux (fwd)

[Praveen Kumar Amritaluru]

Andi,

> > > > 	This  seems  to be a bug.  Has it been  already  fixed in  later
> > > > 	kernel versions or is this how it is intended to remain?
> > > 
> > > iirc this was intentional. The RFC suggested method doesn't work when talking to 
> > > some stacks.
> > > 
> > 
> > 	But  that  cannot  be  valid  enough   justification  for  doing
> > 	something against RFC right?
> 
> Of course it is. Welcome to the real world. RFC1122 has a lot of bugs and sometimes
> does not describe really implemented practice (e.g. BSD set the defacto standard
> in many behaviours and it does not always follow 1122) 

	So do u consider mandating definition of zero-window probes as defined
	in RFC793 as a bug in RFC1122?

	Or else r u saying this bug is introduced in linux to take care of
	faulty stacks existing in the world. zero-window probes as defined
	in RFC1122 is not buggy right?

-Praveen

> 
> -Andi
> 

Re: zero window probes on linux (fwd)

[Andi Kleen]

On Wed, 14 Apr 2004 17:35:33 +0530 (IST)
Praveen Kumar Amritaluru <praveen@india.hp.com> wrote:

> > > > > 	This  seems  to be a bug.  Has it been  already  fixed in  later
> > > > > 	kernel versions or is this how it is intended to remain?
> > > > 
> > > > iirc this was intentional. The RFC suggested method doesn't work when talking to 
> > > > some stacks.
> > > > 
> > > 
> > > 	But  that  cannot  be  valid  enough   justification  for  doing
> > > 	something against RFC right?
> > 
> > Of course it is. Welcome to the real world. RFC1122 has a lot of bugs and sometimes
> > does not describe really implemented practice (e.g. BSD set the defacto standard
> > in many behaviours and it does not always follow 1122) 
> 
> 	So do u consider mandating definition of zero-window probes as defined
> 	in RFC793 as a bug in RFC1122?

They are not directly a bug, but are just not what the world standardized on. 

 
> 	Or else r u saying this bug is introduced in linux to take care of
> 	faulty stacks existing in the world. zero-window probes as defined
> 	in RFC1122 is not buggy right?

Implementing a production network stack is not about following some standard to the 
letter, but about interoperating with real implementations in a useful matter.
Linux does that.

-Andi

Re: zero window probes on linux (fwd)

[Praveen Kumar Amritaluru]

> > > > > > 	This  seems  to be a bug.  Has it been  already  fixed in  later
> > > > > > 	kernel versions or is this how it is intended to remain?
> > > > > 
> > > > > iirc this was intentional. The RFC suggested method doesn't work when talking to 
> > > > > some stacks.
> > > > > 
> > > > 
> > > > 	But  that  cannot  be  valid  enough   justification  for  doing
> > > > 	something against RFC right?
> > > 
> > > Of course it is. Welcome to the real world. RFC1122 has a lot of bugs and sometimes
> > > does not describe really implemented practice (e.g. BSD set the defacto standard
> > > in many behaviours and it does not always follow 1122) 
> > 
> > 	So do u consider mandating definition of zero-window probes as defined
> > 	in RFC793 as a bug in RFC1122?
> 
> They are not directly a bug, but are just not what the world standardized on. 


	Are u aware of other production network stacks sending unacceptable
	segment as a zero-window probe? Can you list them. This is just for
	my information.

> 
>  
> > 	Or else r u saying this bug is introduced in linux to take care of
> > 	faulty stacks existing in the world. zero-window probes as defined
> > 	in RFC1122 is not buggy right?
> 
> Implementing a production network stack is not about following some standard to the 
> letter, but about interoperating with real implementations in a useful matter.
> Linux does that.
> 
> -Andi

Re: zero window probes on linux (fwd)

[Praveen Kumar Amritaluru]

> > > > > > 	This  seems  to be a bug.  Has it been  already  fixed in  later
> > > > > > 	kernel versions or is this how it is intended to remain?
> > > > > 
> > > > > iirc this was intentional. The RFC suggested method doesn't work when talking to 
> > > > > some stacks.
> > > > > 
> > > > 
> > > > 	But  that  cannot  be  valid  enough   justification  for  doing
> > > > 	something against RFC right?
> > > 
> > > Of course it is. Welcome to the real world. RFC1122 has a lot of bugs and sometimes
> > > does not describe really implemented practice (e.g. BSD set the defacto standard
> > > in many behaviours and it does not always follow 1122) 
> > 
> > 	So do u consider mandating definition of zero-window probes as defined
> > 	in RFC793 as a bug in RFC1122?
> 
> They are not directly a bug, but are just not what the world standardized on. 
> 
>  
> > 	Or else r u saying this bug is introduced in linux to take care of
> > 	faulty stacks existing in the world. zero-window probes as defined
> > 	in RFC1122 is not buggy right?
> 
> Implementing a production network stack is not about following some standard to the 
> letter, but about interoperating with real implementations in a useful matter.
> Linux does that.

	I checked the following vendor Operating Systems:

	HPUX, SunOS 5.8, FreeBSD 4.9.

	All of them send  zero-window  probes as per RFC1122.  If BSD is
	considered the defacto standard then why is linux deviating from
	BSD in this aspect?

	Do u mean to say  the  above  will  not  interoperate  with  the
	production  network stacks which u r talking.  BTW which r those
	production network stacks u r referring to?


	Is there  any  other  linux  mailing-lists  where I can get most
	appropriate response?

-Praveen


> 
> -Andi
>