Re: PF suddenly malfunctioned

2012-07-24 Thread Jason Mattax
On 07/24/2012 11:12 AM, Daniel Hartmeier wrote: On Tue, Jul 24, 2012 at 08:41:54AM -0600, Jason Mattax wrote: If the upstream router does HTTP inspection, it might be buggy (since the thunderstorm? :) and react to different HTTP headers. Or it might run an (broken) antivirus patterns on the HTT

RE: PF suddenly malfunctioned

2012-07-24 Thread Greg Hennessy
> > On 07/24/2012 01:07 AM, Daniel Hartmeier wrote: > > What's the client OS? > > > The client OS for this test is Ubuntu 12.04 LTS > > jmattax@chani:~/pf_debugging$ uname -a > Linux chani 3.2.0-26-generic #41-Ubuntu SMP Thu Jun 14 16:26:01 UTC 2012 > i686 i686 i386 GNU/Linux > > > It looks like

Re: PF suddenly malfunctioned

2012-07-24 Thread Daniel Hartmeier
On Tue, Jul 24, 2012 at 08:41:54AM -0600, Jason Mattax wrote: > The other thing I did was I accessed the wikipedia server at > 208.80.154.225 on the firewall. I did this so that I could do the nc > command on the firewall, the output of the tcpdump of which is attached > as xl0_tcpdump_nc and s

Re: PF suddenly malfunctioned

2012-07-24 Thread Jason Mattax
On 07/24/2012 01:07 AM, Daniel Hartmeier wrote: What's the client OS? The client OS for this test is Ubuntu 12.04 LTS jmattax@chani:~/pf_debugging$ uname -a Linux chani 3.2.0-26-generic #41-Ubuntu SMP Thu Jun 14 16:26:01 UTC 2012 i686 i686 i386 GNU/Linux It looks like it might be an inco

Re: PF suddenly malfunctioned

2012-07-24 Thread Daniel Hartmeier
What's the client OS? It looks like it might be an incompatibility between the client and the peculiar wikipedia server (or loadbalancer or proxy or whatever there is). Like the GET request gets lost, but the FIN arrives, and the server selectively ACKs the FIN, and the client doesn't retransmit