Strange TCP behaviour

From: Bruno De Graef (degraefb_at_hotmail.com)
Date: 05/27/04 

Date: 27 May 2004 02:08:09 -0700

Hi all,

I'll start be describing our current situation. We have an apache
1.3.19 ( old version, I know it but we need it due to compatibility
reasons with the application, an new version is in the pipe. ) running
as a reverse proxy. The host OS is running Solaris 2.8 with multiple
virtual addresses defined for 1 interface. Clients ( from remote sites
) are connecting through VPN towards this reverse proxy.

However since 2 weeks clients are complaining from timeouts from time
to time in the browser, where they need to refresh there page. After
having sniffed the network - client / server / switch - ( because
nothing was showing up in log files ) we found the following strange
behaviour in the TCP session.

1. Client SYN => Server
2. Server ACK => Client ????????
3. Client RST => Server
4. Client SYN => Server
5. Server SYN ACK => Client
6. Client ACK => Server
7. Server ACK => Client

As you can see the tree-way handshake is disturbed by the server
sending and ACK to the client with a higher packet number on the
intial SYN request.

We are completely lost on the issue. Even our Telecom guys can't
explain the behaviour. Therefore we would like some advise on how to
explain the behaviour.

Please find here a description on our architecture :
< Server 1 > - <SWITCH> - <Loadbalancer > - <Firewall> - <VPN> - <NAT
Firewall> - <Switch> - <Client PC>

Relevant Pages

  • Re: What doesnt lend itself to OO?
    ... >> proxy and instructs the server to constuct the real object. ... rather than client code. ... If 'clock' is instantiated in the server, ... > for the server interface at the OOA level. ...
    (comp.object)
  • This is going straight to the pool room
    ... or not the client has privilege to do what they're trying to do, ... The server environment is this: ... 3GL User action Routines that Tier3 will execute on your behalf during the ... Routine Name: USER_INIT ...
    (comp.os.vms)
  • [Full-Disclosure] R: Full-Disclosure Digest, Vol 3, Issue 42
    ... Full-Disclosure Digest, Vol 3, Issue 42 ... SD Server 4.0.70 Directory Traversal Bug ... Arkeia Network Backup Client Remote Access ...
    (Full-Disclosure)
  • Re: UDP server scalability question
    ... why are you setting up an ACK on UDP? ... If this is all the server does, spawning multiple threads will most likely ... Unless the ACK is giving data (what the client should ...
    (microsoft.public.dotnet.framework)
  • Re: tcpdump question
    ... F is for FIN ... client> server SYN ... sever> client SYN ACK ...
    (freebsd-questions)