lkml.org 
[lkml]   [2004]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: 2.6.9 tcp problems
Stephen Hemminger wrote:

> On Mon, 29 Nov 2004 13:03:34 -0500
> kernel <kernel@nea-fast.com> wrote:
>
>
>
>> I've run into a problem with 2.6.(8.1,9) after installing a secondary
>> firewall. When I try to pull data through the original firewall
>> (mail, http, ssh), it stops after approx. 260k. Running ethereal
>> tells me "A segment before the frame was lost" followed by a bunch
>> of "This is a TCP duplicate ack" when using ssh. All 2.4.x machines
>> and windows clients work fine. I built 2.4.28 and it works fine from
>> my machine. I also fiddled with tcp_ecn and that didn't fix it
>> either. I don't have any problems communicating to "local" machines.
>> I've attached the tcpdump output from an scp attempt. NIC is a 3Com
>> Corporation 3c905B.
>>
>
>
> What kind of firewall? There are firewalls that are too stupid and don't
> understand TCP window scaling.
>
>
>
It's a fortigate 60. We put our secure web servers behind a netscreen 5
firewall which plugs into the fortigate and that's when the problems
started. I remember reading some stuff on lkm about recent tcp changes
but I couldn't remember exactly what it was. Thanks for reminding me !

Here is how it's layed out now
secure_web_servers->netscreen->fortigate->rest_of_network

Thanks !
walt

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:08    [W:0.285 / U:0.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site