SACK (and PF) wierdness

[Daniel Hartmeier]

Pawel, could you provide a tcpdump -nvvvSXpi <if> for an entire
connection, from handshake to the point where it stalls? Please include
the corresponding 'BAD state'/'State failure' messages and output of
pfctl -vvss related to the connection (ideally all for the same
connection, so timestamps are comparable).

If the output is too long to post here, put it on a web server and post
the URL, or mail the dump to Max and me privately.

It does look like one peer is violating the other's window by sending
too much data before acknowledgement. The state has picked up on the
window scaling, so we need to see the entire TCP connection to determine
whether the packet is dropped correctly or not.

Daniel