thr3ads.net - freebsd stable - connection reset after second syn-ack was sent (FreeBSD 7.0) [Apr 2008]

If this information is useful, please help other people find it:
Share via:

Holger Kipp

2008-Apr-18 13:13 UTC

connection reset after second syn-ack was sent (FreeBSD 7.0)

Hello,

I have a little problem here that is driving me nuts:

I occasionally experience the following:
2008-04-18 10:38:46.454495 IP 192.168.1.1.55784 > 192.168.188.188.515: S
2765551688:2765551688(0) win 32768 <mss 1460,wscale 0,nop>
2008-04-18 10:38:46.454507 IP 192.168.188.188.515 > 192.168.1.1.55784: S
3468383339:3468383339(0) ack 2765551689 win 65535 <mss 1460,nop,wscale 3>
2008-04-18 10:38:49.453868 IP 192.168.188.188.515 > 192.168.1.1.55784: S
3468383339:3468383339(0) ack 2765551689 win 65535 <mss 1460,nop,wscale 3>
2008-04-18 10:38:49.722767 IP 192.168.1.1.55784 > 192.168.188.188.515: . ack
1 win 32768
2008-04-18 10:38:49.722786 IP 192.168.188.188.515 > 192.168.1.1.55784: R
3468383340:3468383340(0) win 0
2008-04-18 10:38:49.727926 IP 192.168.1.1.55784 > 192.168.188.188.515: P
1:7(6) ack 1 win 32768
2008-04-18 10:38:49.819709 IP 192.168.188.188.515 > 192.168.1.1.55784: P
1:2(1) ack 7 win 65535
2008-04-18 10:38:50.006543 IP 192.168.1.1.55784 > 192.168.188.188.515: R
2765551695:2765551695(0) win 0

and

2008-04-18 15:30:31.256246 IP 192.168.1.1.53597 > 192.168.188.188.515: S
1236263266:1236263266(0) win 32768 <mss 1460,wscale 0,nop>
2008-04-18 15:30:31.256257 IP 192.168.188.188.515 > 192.168.1.1.53597: S
559988198:559988198(0) ack 1236263267 win 65535 <mss 1460,nop,wscale 3>
2008-04-18 15:30:34.255479 IP 192.168.188.188.515 > 192.168.1.1.53597: S
559988198:559988198(0) ack 1236263267 win 65535 <mss 1460,nop,wscale 3>
2008-04-18 15:30:34.440092 IP 192.168.1.1.53597 > 192.168.188.188.515: . ack
1 win 32768
2008-04-18 15:30:34.440112 IP 192.168.188.188.515 > 192.168.1.1.53597: R
559988199:559988199(0) win 0
2008-04-18 15:30:34.496849 IP 192.168.1.1.53597 > 192.168.188.188.515: P
1:7(6) ack 1 win 32768
2008-04-18 15:30:34.596461 IP 192.168.188.188.515 > 192.168.1.1.53597: . ack
7 win 65535
2008-04-18 15:30:34.620914 IP 192.168.188.188.515 > 192.168.1.1.53597: P
1:2(1) ack 7 win 65535
2008-04-18 15:30:34.780723 IP 192.168.1.1.53597 > 192.168.188.188.515: R
1236263273:1236263273(0) win 0
2008-04-18 15:30:34.804966 IP 192.168.1.1.53597 > 192.168.188.188.515: R
1236263273:1236263273(0) win 0

(IP addresses changed to protect the innocent ;-)

Can anyone enlighten me as to why the freebsd printserver (192.168.188.188) is
sending
a reset after ack had been received - this only happens if no answer was
received for the
first syn-ack reply, so a second one is send out?

System is 7.0-RELEASE out of the box on a single-processor 2.4GHz P4 Compaq with
1 GB
main memory, with lpd configured.


Here the usual behaviour (I would expect this to be the same even with two
syn-acks send back):

2008-04-18 10:38:47.921055 IP 192.168.1.1.55786 > 192.168.188.188.515: S
2765866087:2765866087(0) win 32768 <mss 1460,wscale 0,nop>
2008-04-18 10:38:47.921081 IP 192.168.188.188.515 > 192.168.1.1.55786: S
4178311531:4178311531(0) ack 2765866088 win 65535 <mss 1460,nop,wscale 3>
2008-04-18 10:38:48.389707 IP 192.168.1.1.55786 > 192.168.188.188.515: P
1:7(6) ack 1 win 32768
2008-04-18 10:38:48.488906 IP 192.168.188.188.515 > 192.168.1.1.55786: . ack
7 win 8211
2008-04-18 10:38:49.760593 IP 192.168.188.188.515 > 192.168.1.1.55786: P
1:2(1) ack 7 win 8212
2008-04-18 10:38:49.945735 IP 192.168.1.1.55786 > 192.168.188.188.515: P
7:26(19) ack 2 win 32768
2008-04-18 10:38:49.946002 IP 192.168.188.188.515 > 192.168.1.1.55786: P
2:3(1) ack 26 win 8212
2008-04-18 10:38:50.236467 IP 192.168.1.1.55786 > 192.168.188.188.515: P
26:1050(1024) ack 3 win 32768
2008-04-18 10:38:50.244742 IP 192.168.1.1.55786 > 192.168.188.188.515: P
1050:2074(1024) ack 3 win 32768
2008-04-18 10:38:50.244762 IP 192.168.188.188.515 > 192.168.1.1.55786: . ack
2074 win 8084
2008-04-18 10:38:50.253217 IP 192.168.1.1.55786 > 192.168.188.188.515: P
2074:3098(1024) ack 3 win 32768
2008-04-18 10:38:50.261559 IP 192.168.1.1.55786 > 192.168.188.188.515: P
3098:4122(1024) ack 3 win 32768
2008-04-18 10:38:50.261571 IP 192.168.188.188.515 > 192.168.1.1.55786: . ack
4122 win 8084
[..]
2008-04-18 10:38:51.236260 IP 192.168.1.1.55786 > 192.168.188.188.515: P
26200:26201(1) ack 5 win 32768
2008-04-18 10:38:51.236271 IP 192.168.188.188.515 > 192.168.1.1.55786: . ack
26201 win 8212
2008-04-18 10:38:51.236289 IP 192.168.188.188.515 > 192.168.1.1.55786: P
5:6(1) ack 26201 win 8212
2008-04-18 10:38:51.539638 IP 192.168.1.1.55786 > 192.168.188.188.515: F
26201:26201(0) ack 6 win 32768
2008-04-18 10:38:51.539667 IP 192.168.188.188.515 > 192.168.1.1.55786: . ack
26202 win 8212
2008-04-18 10:38:51.539713 IP 192.168.188.188.515 > 192.168.1.1.55786: P
6:7(1) ack 26202 win 8212
2008-04-18 10:38:51.540199 IP 192.168.188.188.515 > 192.168.1.1.55786: F
7:7(0) ack 26202 win 8212
2008-04-18 10:38:51.751202 IP 192.168.1.1.55786 > 192.168.188.188.515: R
2765892289:2765892289(0) win 32768
2008-04-18 10:38:51.751539 IP 192.168.1.1.55786 > 192.168.188.188.515: R
2765892289:2765892289(0) win 0

Best regards,
Holger Kipp

Holger Kipp

2008-Apr-20 18:23 UTC

head link

[FOUND] connection reset after second syn-ack was sent (FreeBSD 7.0)

On Fri, Apr 18, 2008 at 03:13:18PM +0200, Holger Kipp
wrote:> I have a little problem here that is driving me nuts:
Found it (must have been blind) - sorry for wasting the bandwidth...
> I occasionally experience the following:
> 2008-04-18 10:38:46.454495 IP 192.168.1.1.55784 > 192.168.188.188.515: S
2765551688:2765551688(0) win 32768 <mss 1460,wscale 0,nop>
> 2008-04-18 10:38:46.454507 IP 192.168.188.188.515 > 192.168.1.1.55784: S
3468383339:3468383339(0) ack 2765551689 win 65535 <mss 1460,nop,wscale 3>
> 2008-04-18 10:38:49.453868 IP 192.168.188.188.515 > 192.168.1.1.55784: S
3468383339:3468383339(0) ack 2765551689 win 65535 <mss 1460,nop,wscale 3>
> 2008-04-18 10:38:49.722767 IP 192.168.1.1.55784 > 192.168.188.188.515: .
ack 1 win 32768
> 2008-04-18 10:38:49.722786 IP 192.168.188.188.515 > 192.168.1.1.55784: R
3468383340:3468383340(0) win 0
> 2008-04-18 10:38:49.727926 IP 192.168.1.1.55784 > 192.168.188.188.515: P
1:7(6) ack 1 win 32768
> 2008-04-18 10:38:49.819709 IP 192.168.188.188.515 > 192.168.1.1.55784: P
1:2(1) ack 7 win 65535
> 2008-04-18 10:38:50.006543 IP 192.168.1.1.55784 > 192.168.188.188.515: R
2765551695:2765551695(0) win 0
dhcp-383-1# tcpdump -n -l -tttt -vvv -S -r 20080417_tcpdump_ru_all_515.dump port
53479
reading from file 20080417_tcpdump_ru_all_515.dump, link-type EN10MB (Ethernet)
2008-04-19 16:38:28.149039 IP (tos 0x0, ttl 53, id 64087, offset 0, flags [DF],
proto TCP (6), length 48) 192.168.1.1.53479 > 192.168.188.188.515: S, cksum
0x7a8f (correct), 2316685919:2316685919(0) win 32768 <mss 1460,wscale
0,nop>
2008-04-19 16:38:28.149091 IP (tos 0x0, ttl 64, id 14400, offset 0, flags [DF],
proto TCP (6), length 48) 192.168.188.188.515 > 192.168.1.1.53479: S, cksum
0xded3 (correct), 1506132195:1506132195(0) ack 2316685920 win 65535 <mss
1460,nop,wscale 3>
2008-04-19 16:38:31.148742 IP (tos 0x0, ttl 64, id 14401, offset 0, flags [DF],
proto TCP (6), length 48) 192.168.188.188.515 > 192.168.1.1.53479: S, cksum
0xded3 (correct), 1506132195:1506132195(0) ack 2316685920 win 65535 <mss
1460,nop,wscale 3>
2008-04-19 16:38:31.332618 IP (tos 0x0, ttl 53, id 64089, offset 0, flags [DF],
proto TCP (6), length 40) 192.168.1.1.53479 > 192.168.188.188.515: ., cksum
0x8a94 (correct), 2316685926:2316685926(0) ack 1506132196 win 32768
2008-04-19 16:38:31.332634 IP (tos 0x0, ttl 64, id 14402, offset 0, flags [DF],
proto TCP (6), length 40) 192.168.188.188.515 > 192.168.1.1.53479: R, cksum
0x671d (correct), 1506132196:1506132196(0) win 0
2008-04-19 16:38:31.395882 IP (tos 0x0, ttl 53, id 64090, offset 0, flags [DF],
proto TCP (6), length 46) 192.168.1.1.53479 > 192.168.188.188.515: P, cksum
0xdedb (correct), 2316685920:2316685926(6) ack 1506132196 win 32768
2008-04-19 16:38:31.468651 IP (tos 0x0, ttl 64, id 14417, offset 0, flags [DF],
proto TCP (6), length 41) 192.168.188.188.515 > 192.168.1.1.53479: P, cksum
0x0a8c (correct), 1506132196:1506132197(1) ack 2316685926 win 65535
2008-04-19 16:38:31.652240 IP (tos 0x0, ttl 53, id 64091, offset 0, flags [DF],
proto TCP (6), length 40) 192.168.1.1.53479 > 192.168.188.188.515: R, cksum
0x254b (correct), 2316685926:2316685926(0) win 0

OK, so this is what happenes:
 
ID 64087   receive SYN 19:19
--------   send SYN-ACK 95:95 for 20
--------   send SYN-ACK 95.95 for 20 again after three seconds
ID 64089   receive ACK 26:26  for 96 (interesting, not 20:26)
--------   send RST because ACK is not 20:xx, I assume
ID 64090   receive ACK 20:26  for 96 
                   but shouldn't the ID be in sequence?
--------   send ACK 96:97 for 26
                   as we got the correct ACK now.
ID 64091   receive RST 26:26 


Well, still open questions here. Sight. 
Suggestions welcome. Ah, the initiating system is HP-UX...

Anyway, thanks for listening.

Best regards,
Holger Kipp

freebsd stable - Apr 2008 - connection reset after second syn-ack was sent (FreeBSD 7.0)

connection reset after second syn-ack was sent (FreeBSD 7.0)

[FOUND] connection reset after second syn-ack was sent (FreeBSD 7.0)