* PROBLEM: TCP CWR and ECE flags
@ 2002-03-21 2:44 SUZUKI Yasuhiro
2002-03-21 7:17 ` Neil Spring
0 siblings, 1 reply; 2+ messages in thread
From: SUZUKI Yasuhiro @ 2002-03-21 2:44 UTC (permalink / raw)
To: linux-kernel; +Cc: ysuzuki
[1] Handling TCP flags CWR and ECE
[2]
I can not connect to a ftp server
with /usr/bin/ftp from Linux 2.4.18
kernel though I can from Linux
2.2.20 kernel. And I can connect to
other ftp servers even if from 2.4.18
kernel.
A web page
http://www.icir.org/floyd/papers/ECN.Oct2000.txt
says that
* If Host A does not get any reply to its initial SYN (which had CWR
and ECE set) within the normal SYN retransmission timeout interval,
then Host A resends the SYN and any subsequent SYN retransmissions
with CWR and ECE cleared.
where Host A is a client and Host B is a server.
But my firewall log says:
Mar 20 21:41:01 litium kernel: IN=eth0 OUT=eth1 SRC=192.168.1.4
DST=211.125.48.158 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=383 DF
PROTO=TCP SPT=1052 DPT=21 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Mar 20 21:41:04 litium kernel: IN=eth0 OUT=eth1 SRC=192.168.1.4
DST=211.125.48.158 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=384 DF
PROTO=TCP SPT=1052 DPT=21 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Mar 20 21:41:10 litium kernel: IN=eth0 OUT=eth1 SRC=192.168.1.4
DST=211.125.48.158 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=385 DF
PROTO=TCP SPT=1052 DPT=21 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Mar 20 21:41:22 litium kernel: IN=eth0 OUT=eth1 SRC=192.168.1.4
DST=211.125.48.158 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=386 DF
PROTO=TCP SPT=1052 DPT=21 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
Because there is no response from the ftp server, the CWR and ECE flags of
TCP SYN packets other than the first one must be cleared. I think
the log shows a bug in kernel 2.4.18.
[3] Networking, TCP, CWR and ECE
[4] Linux version 2.4.18 (root@hydrogen) (gcc version egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)) #1 Mar 16 2002 00:01:37 JST
[5]
[6]
[7]
[7.1]
Ftp command I use is:
-rwxr-xr-x 1 root root 64860 May 2 2000 /usr/bin/ftp
This comes from Vine linux 2.15, a Linux distribution
popular in Japan. I tried to get a copyright message
from the command with some options as '-h', '--help',
'--version' or '-hv' and could not get.
If some fields are empty or look unusual you may have an old version.
Compare to the current minimal requirements in Documentation/Changes.
Linux hydrogen 2.4.18 #1 2002年 3月16日(土) 00時01分37秒 JST i686 unknown
Gnu C egcs-2.91.66
Gnu make 3.79
binutils 2.9.5.0.34
util-linux 2.10f
mount 2.10f
modutils 2.3.21
e2fsprogs 1.27
pcmcia-cs 3.1.30
Linux C Library 2.1.3
Dynamic linker (ldd) 2.1.3
Procps 2.0.6
Net-tools 1.54
Console-tools 0.3.3
Sh-utils 2.0
Modules Loaded soundcore sd_mod apa1480_cb scsi_mod cb_enabler pcnet_cs 8390 ds i82365 pcmcia_core nls_cp437 vfat fat
[7.2]
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 8
model name : Celeron (Coppermine)
stepping : 3
cpu MHz : 497.846
cache size : 128 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 2
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 sep mtrr pge mca cmov pat pse36 mmx fxsr sse
bogomips : 992.87
[7.3]
soundcore 3472 0 (autoclean)
sd_mod 10176 2 (autoclean)
apa1480_cb 108021 2
scsi_mod 50496 2 [sd_mod apa1480_cb]
cb_enabler 2384 2 [apa1480_cb]
pcnet_cs 12800 1
8390 5888 0 [pcnet_cs]
ds 6528 2 [cb_enabler pcnet_cs]
i82365 21648 2
pcmcia_core 41248 0 [cb_enabler pcnet_cs ds i82365]
nls_cp437 4352 2 (autoclean)
vfat 9808 1 (autoclean)
fat 30912 0 (autoclean) [vfat]
[7.4]
0000-001f : dma1
0020-003f : pic1
0040-005f : timer
0060-006f : keyboard
0080-008f : dma page reg
00a0-00bf : pic2
00c0-00df : dma2
00f0-00ff : fpu
0170-0177 : ide1
01f0-01f7 : ide0
0200-02ff : aic7xxx
0300-031f : pcnet_cs
0376-0376 : ide1
03c0-03df : vga+
03f6-03f6 : ide0
03f8-03ff : serial(auto)
0800-083f : Intel Corp. 82371AB PIIX4 ACPI
0840-085f : Intel Corp. 82371AB PIIX4 ACPI
0860-086f : Intel Corp. 82371AB PIIX4 IDE
0860-0867 : ide0
0868-086f : ide1
0cf8-0cff : PCI conf1
d800-d8ff : ESS Technology ES1983S Maestro-3i PCI Audio Accelerator
dce0-dcff : Intel Corp. 82371AB PIIX4 USB
e000-efff : PCI Bus #01
ec00-ecff : ATI Technologies Inc Rage Mobility P/M AGP 2x
00000000-0009fbff : System RAM
0009fc00-0009ffff : reserved
000a0000-000bffff : Video RAM area
000c0000-000c7fff : Video ROM
000f0000-000fffff : System ROM
00100000-07febfff : System RAM
00100000-0021668c : Kernel code
0021668d-0026e2ff : Kernel data
07fec000-07feffff : reserved
10000000-10000fff : Texas Instruments PCI1225
10000000-10000fff : i82365
10001000-10001fff : Texas Instruments PCI1225 (#2)
10001000-10001fff : i82365
100a0000-100fffff : reserved
a0000000-a0000fff : card services
a0020000-a0030fff : cb_enabler
f4000000-f7ffffff : Intel Corp. 440BX/ZX - 82443BX/ZX Host bridge
faffe000-faffffff : ESS Technology ES1983S Maestro-3i PCI Audio Accelerator
fc000000-feffffff : PCI Bus #01
fcfff000-fcffffff : ATI Technologies Inc Rage Mobility P/M AGP 2x
fd000000-fdffffff : ATI Technologies Inc Rage Mobility P/M AGP 2x
ffe00000-ffffffff : reserved
[7.5]
[root@hydrogen ysuzuki]# /sbin/lspci -vvv
pcilib: Cannot open /proc/bus/pci/06/00.0
lspci: Unable to read 64 bytes of configuration space.
[7.6]
Attached devices:
Host: scsi0 Channel: 00 Id: 01 Lun: 00
Vendor: MELCO Model: DSU-GTH Rev: 1.0H
Type: Direct-Access ANSI SCSI revision: 03
Host: scsi0 Channel: 00 Id: 02 Lun: 00
Vendor: MELCO Model: DSC-G Rev: 1.00
Type: Direct-Access ANSI SCSI revision: 02
[7.7]
I have a small LAN 192.168.1.0/24. There is
a firewall between the LAN and the Internet.
The firewall is a linux box with kernel 2.4.18
and connected via ADSL to the Internet.
### The firewall rule (only about TCP)###
Chain INPUT (policy DROP)
target prot opt source destination
LOG tcp -- anywhere !255.255.255.255 LOG level warning
ACCEPT tcp -- 192.168.1.0/24 anywhere tcp spt:smtp
ACCEPT tcp -- 192.168.1.0/24 anywhere tcp dpt:ssh
ACCEPT udp -- loopback/8 loopback/8
ACCEPT tcp -- loopback/8 loopback/8
Chain FORWARD (policy DROP)
target prot opt source destination
LOG tcp -- anywhere anywhere LOG level warning
ACCEPT tcp -- 192.168.1.0/24 !255.255.255.255 tcp spts:1024:65535
ACCEPT tcp -- !192.168.1.0/24 192.168.1.0/24 tcp dpts:1024:65535 state ESTABLISHED
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
### The firewall rule ###
------------------------------------------------------------
SUZUKI Yasuhiro
living in Edogawa-ku, Tokyo, Japan
ysuzuki@bb.mbn.or.jp
yasu@ysuzuki.net
http://plaza8.mbn.or.jp/~yswww/myself/ (only in Japanese)
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: PROBLEM: TCP CWR and ECE flags
2002-03-21 2:44 PROBLEM: TCP CWR and ECE flags SUZUKI Yasuhiro
@ 2002-03-21 7:17 ` Neil Spring
0 siblings, 0 replies; 2+ messages in thread
From: Neil Spring @ 2002-03-21 7:17 UTC (permalink / raw)
To: yasu; +Cc: linux-kernel, ysuzuki
On Thu, Mar 21, 2002 at 11:44:03AM +0900, SUZUKI Yasuhiro wrote:
> A web page
> http://www.icir.org/floyd/papers/ECN.Oct2000.txt
> says that
> * If Host A does not get any reply to its initial SYN (which had CWR
> and ECE set) within the normal SYN retransmission timeout interval,
> then Host A resends the SYN and any subsequent SYN retransmissions
> with CWR and ECE cleared.
> where Host A is a client and Host B is a server.
It also says:
This note outlines a procedure that ECN-Capable TCP implementations
may wish to use in this case to ensure connectivity. We are not
suggesting that TCP implementations should be required to use this
procedure.
If you don't like linux's behavior,
su
echo 0 > /proc/sys/net/ipv4/tcp_ecn
echo "net/ipv4/tcp_ecn=0" >> /etc/sysctl.conf
If you don't like nifty.com's ECN violating behavior,
send them mail.
See the faq, as mentioned at the footer of all
Linux-kernel mailing lists, and specifically at
http://www.tux.org/lkml/#s14-2 for additional information.
-neil
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2002-03-21 7:17 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2002-03-21 2:44 PROBLEM: TCP CWR and ECE flags SUZUKI Yasuhiro
2002-03-21 7:17 ` Neil Spring
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®