On Tue, 10 Jul 2007, Eygene Ryabinkin wrote:
Can't say that I am pushing much traffic through my box, but after applying your patch and rebuilding the kernel I am still seeing the messages like ----- TCP: [209.132.176.NNN]:NNN to [144.206.NNN.NNN]:NNN tcpflags 0x19<FIN,PUSH,ACK>; syncache_expand: Segment failed SYNCOOKIE authentication, segment rejected (probably spoofed) TCP: [201.90.65.NNN]:NNN to [144.206.NNN.NNN]:NNN; syncache_timer: Response timeout ----- But what had changed is that the lines with the 'syncache_timer' started to appear. There were no such lines prior to the patch, only the 'failed SYNCOOKIE' ones.
The "syncache_timer: Response timeout" message means that the syncache sent a SYN-ACK response four times, but still didn't receive a response. This probably means that someone tried using a port scanner or was going through a faulty firewall. We'll definitely have to take that log message out before 7.0 is released.
The fact that you're still getting the syncache_expand message tells me that there's another bug which I have not yet fixed still present.
My suspicion is that the "Segment failed SYNCOOKIE authentication" message is the aftereffect of FreeBSD 7 randomly dropping TCP connections, and not the problem itself. My theory is that the connection is silently dropped, without the other endpoint knowing. That other endpoint then sends an ACK packet, which is then believed to be a syncookie. Since it is not, it obviously fails the verification.
Finding that bug is my next goal.
But the patch received only half a day of testing, so I will continue the tests and will inform you if some other information will be available. Up to date I don't see problems that had appeared without the patch, but they tend to show up after a midnight ;)) Thank you!
Thanks for testing, I look forward to hearing how things work for you. Mike "Silby" Silbersack _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
