[lkml]   [2000]   [Sep]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectECN & cisco firewall

Following a discussion about ECN and firewalls some days ago:

We have the same problem here with several Cisco PIX Firewalls not
handling ECN correctly. After a little research we think we know what is
going wrong: The firewall checks the TCP-Header against rfc793. There it
is stated for the Reserved Bits:

Reserved: 6 bits

Reserved for future use. Must be zero.

The point is: 'must be zero' is redefined by rfc2481 (ECN). (The
firewall-people at cisco do not seem to be fully aware of that yet.) The
firewall sees a header violating rfc793 and considers it a bogous TCP
packet. So it sends a RST instead of letting the connection pass. The
problem is that this is not caused by misadministration of the firewall.
It seems to be built into the Software.

We already sent this issue to cisco (along with our sniffer logs) and are
now waiting for a reply. :-) (Hopefully they will find a solution before
kernels enabling ECN start do be widely distributed - in Mandrake 7.2beta
it is already tha case.)

LL&P Ulrich
,-, .-.,----,---------------------------------------------------------------
| | / / |,---' Ulrich Kiermayr Inst. for Theoret. Physics, Univ. of Vienna
| |/ /| ||_ eMail: PGP Key ID: 0xA8D764D8
| ( | | _: ICQ: 17858333 Web:
| |\ \| || @Home: Dampierrestr. 4/5, A-1140 Vienna; +43(699)19671909
| | \ \ |`---, @Work: Boltzmanngasse 5, A-1090 Vienna; +43(1)4277/51555
`-' `-''----'---------------------------------------------------------------

They are relatively good but absolutely terrible.
-- Alan Kay, commenting on Apollos

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 12:38    [W:0.079 / U:1.344 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site