strange behaviour in TCP-Connect-Handshake

From: Oliver Joa (ojoa@gatrixx.com)
Date: Fri Aug 02 2002 - 06:28:54 EST

Hi,

we have found something strange in TCP-Connect-Handshake. Here is the
tcpdump of a connect:

12:41:27.997216 eth0 < 217.111.11.28.53656 > 10.10.2.10.www: S
1550641618:1550641618(0) win 5840 <mss 1460,sackOK,timestamp 646924298
0,nop,wscale 0> (DF)

12:41:27.997243 eth0 > 10.10.2.10.www > 217.111.11.28.53656: .
281850:281850(0) ack 124 win 32120 <nop,nop,timestamp 88850 648121803>
(DF)

12:41:27.998085 eth0 < 217.111.11.28.53656 > 10.10.2.10.www: R
1438731713:1438731713(0) win 0 (DF)

217.111.11.28 sends the syn-packet to 10.10.2.10, and 10.10.2.10 answers
with a ack-packet, but without the syn-flag set. I thought this might be
violating the TCP-protcol. It happens 3 to 4 times per second on a
Squid-Server with lots of Requests (100-200 per second). We use the
2.4.18-kernel. We have tried a 2.2.20-kernel and it worked normal.

What could be the problem?

many thanks

Oliver 

-- 
Dipl. Inf. (FH) Oliver Joa
senior IT-architect

Gatrixx NetSolutions GmbH
Karl-Goetz-Strasse 5
97424 Schweinfurt
Fon +49 9721 797 420
Fax +49 9383 999-58
Mobil +49 160 47874 62
E-Mail ojoa@gatrixx.com, ojoa@gmx.net, oliver@j-o-a.de

Weitere Informationen erhalten Sie unter:
http://www.gedif.de/

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Wed Aug 07 2002 - 22:00:18 EST