[ale] Using tcpdump to diagnose website connecting

[Mike Millson]

This explains it:

http://www.tcpdump.org/lists/workers/2001/06/msg00079.html

I turned ECN off as follows:
echo 0 > /proc/sys/net/ipv4/tcp_ecn

As soon as I did that, I'm able to view mrslim.com and mci.com.

Tomorrow I'll have to learn what ECN is and what this all means...

Mike

On Thu, 2003-04-24 at 21:59, James P. Kinney III wrote:
> Mike,
> 
> That is quite strange. My only surmise is that the route to mrslim and
> friends has a problem and is dropping the SYN request. Try a traceroute.
> 
> Also doublecheck your iptables rules. You may have a "drop half open
> connections" line in there. 
> 
> Let us know what you find. I like puzzles. I like solutions, too. :)
> 
> On Thu, 2003-04-24 at 21:49, Mike Millson wrote:
> > Thanks James,
> > 
> > I have no trouble browsing other sites, there's just something about
> > that mrslim site. It also happens when I try to view mci.com. I can view
> > it fine on my windoze machine, but the mci.com server does not respond
> > to my SYN request on my linux box/firewall/gateway. MCI's server is
> > Netscape-Enterprise/4.1.
> > 
> > Mike
> > 
> > On Thu, 2003-04-24 at 21:25, James P. Kinney III wrote: 
> > > Sorry Mike. I should have also suggested to turn off the iptables for a
> > > second and retry. That is the most likely culprit. 
> > > 
> > > Unless, of course you can browse to any other site already from the
> > > Linux box BUT the mrslim.com site. In which case, I'm stumped.
> > > 
> > > It's not a site issue as I can get it here on a RedHat 8 box with galeon
> > > running through a Linux NAT/firewall/gateway.
> > > 
> > > On Thu, 2003-04-24 at 20:56, Mike Millson wrote:
> > > > James,
> > > > 
> > > > The html headers mrslim is apparently running on Apache on Unix:
> > > > Apache/1.3.9 (Unix). Unless the header is forged, mrslim isn't on an IIS
> > > > server.
> > > > 
> > > > Mike 
> > > > 
> > > > On Thu, 2003-04-24 at 20:14, James P. Kinney III wrote:
> > > > > M$ has  a broken tcp stack (still). It will ignore the the initial state
> > > > > connection flags. This is especially  problem with unpatched IIS servers
> > > > > servers that ignore the initiating SYN/ACK on an http connection. 
> > > > > 
> > > > > On Thu, 2003-04-24 at 19:41, Mike Millson wrote:
> > > > > > I have a RH 7.1 box that I am using as a router and does NAT to share my
> > > > > > ADSL connection with a Windoze 2K machine.
> > > > > > 
> > > > > > I cannot connect to www.mrslim.com from the Linux box; however, I can
> > > > > > from the Windoze box.
> > > > > > 
> > > > > > Using tcpdump, I see the difference in the connections is that the
> > > > > > Windoze SYN is ACK'd, but the Linux SYN is not.
> > > > > > 
> > > > > > Here are the relevant tcpdump lines:
> > > > > > 
> > > > > > Router/Server:
> > > > > > 16:56:08.050143 68.157.175.145.53263 > 216.237.21.5.http: SWE
> > > > > > 1875630922:1875630922(0) win 5808 <mss 1452,sackOK,timestamp 852565069
> > > > > > 0,nop,wscale 0> (DF)
> > > > > > 
> > > > > > Windoze machine:
> > > > > > 17:05:05.346259 68.157.175.145.3490 > 216.237.21.5.http: S
> > > > > > 3816606182:3816606182(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
> > > > > > 
> > > > > > I'm running iptables, and any packets I reject are logged. I don't see
> > > > > > any rejected packets logged when the SYN is not answered - just the
> > > > > > connection times out after multiple SYN requests are not answered.
> > > > > > 
> > > > > > Can anyone shed any light what is going on here why the Linux SYN is not
> > > > > > being answered and how I can fix this? How come the linux box issues an
> > > > > > SWE request instead of just S? What is SWE?
> > > > > > 
> > > > > > Thank you,
> > > > > > Mike

_______________________________________________
Ale mailing list
Ale at ale.org
http://www.ale.org/mailman/listinfo/ale