Re: ports beeing reused too fast

[Eric Dumazet <dada1@cosmosbay.com>]

Eric Dumazet a écrit :
> Octavian Purdila a écrit :
>> On Saturday 09 May 2009 09:58:25 Eric Dumazet wrote:
>>
>>>> I've looked over the  code and it looks right, so maybe net_random() is
>>>> not random enough? Or maybe there are side effects because of the %
>>>> port_range?
>>> Random is random :)
>>> Probability a port can be reused pretty fast is not nul.
>>>
>> Thinking again about it... you are right :)
>>
>>> So yes, behavior you discovered is expected, when we switched port
>>> selection from a sequential one (not very secure btw) to a random one.
>>>
>>> Any strong reason why a firewall would drop a SYN because ports were used
>>> in a previous session ?
>> We don't know why the firewall (Cisco FWSM) is dropping the packets, may be a 
>> bug, limitation or miss-configuration. We are trying to track this down with 
>> the firewall vendor.
> 
> Normally, the client machine should not reuse a port during the TIME_WAIT duration
> (TCP_TIMEWAIT_LEN being 60 seconds on linux). Port selection being random or sequential,
> it should avoid all ports recently used.
> 
> Maybe this firewall has a longer TIME_WAIT enforcement (something like 2 minutes)

Another thing to consider is your client/server use or not tcp timestamps (RFC 1323)

# should allow client to use fast reuse of ports (and trigger a firewall problem)
echo 1 >/proc/sys/net/ipv4/tcp_timestamps

If both machines allow tcp timestamps, then same ports can be reused pretty fast.

If firewall doesnt fully understand RFC 1323, it might explain some problem
with port randomization and shortened time between port reuse.