On Thu, Jul 08, 2004 at 08:03:26AM +0200, bert hubert wrote: [ theory that a window tracking firewall drops packets for which it thinks the intended recipient has no room, as they are larger than the window size it sees, where it neglects to scale that window size ] > We could verify this assumption by checking if lowering the MTU to say 700 > allows wscale=3 to work. This has now been confirmed with the packages.gentoo.org firewall! Setting MTU does not help because the kernel adjusts the window size too. However, fiddling with MSS helps. Setting wscale to 3 breaks connectivity to packages.gentoo.org, but one can restore it with: # iptables -t mangle -A OUTPUT -p tcp -o wlan0 -d 198.63.211.232 -j TCPMSS \ --set-mss=742 --tcp-flags SYN,RST SYN 742 is the limit value, note how this is pretty close to the scaled window size of 730. Trace of succesful connection: 08:29:54.799158 192.168.1.4.33116 > 198.63.211.232.80: S 258776237:258776237(0) win 5840 <mss 742,sackOK,timestamp 5528023 0,nop,wscale 3> (DF) 08:29:54.935830 198.63.211.232.80 > 192.168.1.4.33116: S 3729725382:3729725382(0) ack 258776238 win 5792 <mss 1460,sackOK,timestamp 824466134 5528023,nop,wscale 0> (DF) 08:29:54.935997 192.168.1.4.33116 > 198.63.211.232.80: . ack 1 win 730 <nop,nop,timestamp 5528160 824466134> (DF) 08:29:54.936116 192.168.1.4.33116 > 198.63.211.232.80: P 1:107(106) ack 1 win 730 <nop,nop,timestamp 5528160 824466134> (DF) 08:29:55.058090 198.63.211.232.80 > 192.168.1.4.33116: . ack 107 win 5792 <nop,nop,timestamp 824466159 5528160> (DF) 08:29:55.058325 198.63.211.232.80 > 192.168.1.4.33116: . 1:731(730) ack 107 win 5792 <nop,nop,timestamp 824466160 5528160> (DF) 08:29:55.058425 192.168.1.4.33116 > 198.63.211.232.80: . ack 731 win 912 <nop,nop,timestamp 5528283 824466160> (DF) 08:29:55.181172 198.63.211.232.80 > 192.168.1.4.33116: . 731:1461(730) ack 107 win 5792 <nop,nop,timestamp 824466184 5528283> (DF) Packages.gentoo.org is behind a Running: Cisco IOS 12.X OS details: Cisco 7200 router running IOS 12.1(14)E6 OS Fingerprint: Not sure if that would be the culprit though. -- http://www.PowerDNS.com Open source, database driven DNS Software http://lartc.org Linux Advanced Routing & Traffic Control HOWTO - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
