SACK problems

Kris Kennaway kris at obsecurity.org
Thu Feb 10 13:28:54 PST 2005


On Fri, Feb 11, 2005 at 10:15:35AM +1300, Sam Jansen wrote:
> During some testing on an isolated network we have, I found some 
> interesting behaviour from a FreeBSD 5.3 host using TCP SACK.
> 
> I've detailed this problem fully at:
> 
>    http://www.wand.net.nz/~stj2/nsc/emu_freebsd.html
> 
> PCAP traces and some screenshots from tcptrace graphs can be found at 
> the above link to show what is happening. It looks to me like SACK 
> blocks are being incorrectly generated in this example. I can't think of 
> any valid reason why a SACK block would SACK from below the current ACK 
> value to above it (which is the problem here).
> 
> Thoughts, anyone? Am I just wrong here and this is valid, expected 
> behaviour?

A fix to the SACK code was committed yesterday, which may or may not
be relevant.

Kris
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20050210/07a06d1b/attachment.bin


More information about the freebsd-net mailing list