Firewall Sending Resets(was Troubleshooting Netfilter Firewall (performance issues))

Firewall Sending Resets(was Troubleshooting Netfilter Firewall (performance issues))

[Harrison, James]

List,

We have determined, that during large(50-100MB) file transfers the
firewall is spuriously sending a tcp reset to both server and client.

The same file (which is a compressed format to begin with) when zipped
will copy just fine.

Why does the firewall feel the need to pull down the connection?  The
reset(based on TTL counts) is being sent from the primary internal
interface.

This is devil-linux 1.2.6 i686 SMP (2.4.31)

Thanks


-- 
James Harrison RHCE
Manager, Information Security - American Color
PH: 615-377-7426
FX: 615-377-0325
AIM: harrijh1

Re: Firewall Sending Resets(was Troubleshooting Netfilter Firewall (performance issues))

[Jozsef Kadlecsik]

On Fri, 4 Nov 2005, Harrison, James wrote:

> We have determined, that during large(50-100MB) file transfers the
> firewall is spuriously sending a tcp reset to both server and client.
[...]

netfilter sends RST if it was configured to do so by using the REJECT
target.

No vanilla netfilter sends RST to client and server, in any setup.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: Firewall Sending Resets(was Troubleshooting Netfilter Firewall (performance issues))

[Harrison, James]

On Fri, 2005-11-04 at 23:01 +0100, Jozsef Kadlecsik wrote:
> On Fri, 4 Nov 2005, Harrison, James wrote:
> 
> > We have determined, that during large(50-100MB) file transfers the
> > firewall is spuriously sending a tcp reset to both server and client.
> [...]
> 
> netfilter sends RST if it was configured to do so by using the REJECT
> target.
> 
> No vanilla netfilter sends RST to client and server, in any setup.
> 
> Best regards,
> Jozsef
> -
> E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
> PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
> Address : KFKI Research Institute for Particle and Nuclear Physics
>           H-1525 Budapest 114, POB. 49, Hungary

I understand, but the file transfer is initiated, begins, and can and
will run for a period of time, then out of the blue it fires the RST.

Why?

-- 
James Harrison RHCE
Manager, Information Security

Re: Firewall Sending Resets(was Troubleshooting Netfilter Firewall (performance issues))

[Jozsef Kadlecsik]

On Fri, 4 Nov 2005, Harrison, James wrote:

> > netfilter sends RST if it was configured to do so by using the REJECT
> > target.
> >
> > No vanilla netfilter sends RST to client and server, in any setup.
>
> I understand, but the file transfer is initiated, begins, and can and
> will run for a period of time, then out of the blue it fires the RST.

Are you sure the firewall creates the RST segments?

> Why?

Dunno. You should capture the full traffic by tcpdump so that one could
analyze it. Without such a proof nothing much can be said. Also, one would
require the list of netfilter patches (from patch-o-matic or others)
applied on top of kernel 2.4.31 in devil-linux.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary