Re: dtrace to trace incoming connection not suceeding ?

Hi!

> > There's one small diff between the two that I do not understand:
> > 
> > -       18040 times no signature provided by segment
> > +       18045 times no signature provided by segment
> 
> This means, that received TCP segment has not TCP-MD5 signature, but
> listen socket expects it. Such SYN segment will be dropped by syncache
> code. Probably your BGP daemon configured to use TCP-MD5 for connection,
> but remote side does not.

Thanks, that might be another possible cause.

This happened on iBGP sessions where I control both sides
or on eBGP sessions, where I also control both sides (and both
run on FreeBSD). I did not change the frr config during updates,
so I did not expect this to break.

Maybe frr on newer FreeBSD versions handles the tcp-md5 case in some
invalid way. That might be the case and this probably needs to
be analysed.

-- 
pi@FreeBSD.org         +49 171 3101372                  Now what ?