[lkml]   [1999]   [Jan]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: A router bug?
In article <>, (H.J. Lu) writes:
>> > from the remote site. For some reason, the response never comes.
>> > Is that possible for the Linux gateway doesn't forward those bytes
>> > sent to the remote site under certain conditions? What should I
>> > look for?
>> If the MTU of the two links is different you should look for outgoing
>> frames through the router with no reply when the size of reply would be
>> large. Thats a clear indication that the remote site has firewalls set up
>> by overpaid underbrained morons from one of the many rich and clueless
>> consulting firms who think blocking all icmp on a firewall is a valid
>> thing to do.

> I am not sure if it is the case:

> 1. I can access the web site in question on the Linux router.
> 2. Here is the slip interface on the router:

> # ifconfig sl0
> sl0 Link encap:VJ Serial Line IP
> inet addr: P-t-P: Mask:

This explains it. Your other box is connected to an ethernet with MTU of
1500. Thus it sends a MSS option of 1500-X into the initial SYN of the
TCP connection. Now the other server correctly sets its MSS to 1500-X
and sends packets with that size with the Dont-Fragment bit set for PMTU
discovery. Once they reach the other end of your slip link they get dropped
and the router sends back a ICMP frag-needed to tell the other box to lower
its pmtu - but because of the ICMP blocking firewalls set up by people that
were so nicely described by Alan it never sees them. It does not happen
from your router box, because there the first interface has a 576 MTU which
means that TCP only puts a small MSS option in the first SYN, and all packets
that are exchanged are small and no pmtu discovery is needed.

One workaround: set the mtu on the gateway route you use on the other box
(route add default gw ROUTER mss 576), then the MSS will contain small values
from the beginning. It would be better to complain to the sites that don't
work, because it is clearly a misconfiguration on their part. Another workaround
is to increase the sl0 MTU to 1500bytes.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:50    [W:0.060 / U:3.620 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site