>
> Hi,
>
> I got these messages (along with many 'syn-ack rtx', but those are normal)
> while working in a telnet session over a fast (<5ms) ethernet connection:
>
> Nov 16 20:12:22 moisil kernel: syn_ack rtx 1
> Nov 16 21:50:42 moisil kernel: syn timeout
> Nov 16 21:51:21 moisil kernel: syn timeout
> Nov 16 21:52:12 moisil last message repeated 3 times
> Nov 16 21:53:02 moisil last message repeated 2 times
> Nov 16 21:54:10 moisil kernel: syn timeout
> Nov 16 21:55:19 moisil kernel: syn timeout
> Nov 16 21:56:09 moisil kernel: syn timeout
> Nov 16 22:45:20 moisil kernel: syn_ack rtx 1
>
> More precisely, the machine had to send a large amount of data, once
> because of a large copy_and_paste using the mouse, and once (the one
> showed above) because of something scrolling quickly on the tty. In both
> cases, the session got really stuck, (although I could open another telnet
> just fine), and got under way several minutes later. netstat indicated
> that the send-q was rather large - 23000 or something like that. During
> that interval of 5-6 minutes, every now and then (most likely once
> a minute, in sync with the syn timeout messages) several packets made it
> through, but since the application was queuing more stuff, it didn't help
> - the send-q stayed at or around 23000.
>
> Also, on a related issue, netstat was showing several incoming connections
> (smtp and auth) in an UNKNOWN state, with send-q = recv_q = 1. Most of
> them were more than 12 hours old, and seemed to have just stuck there.
> They were definitely _not_ syn-flood traces, as 1. they originated from
> different hosts; 2. those hosts were "trusted" (one being a machine
> I have root on, and another being vger itself with a smtp connection); 3.
> they were just a few (10-12) and didn't prevent in any way other
> connections.
Thank you!! Someone who knows what I'm talking about. I posted a while
ago with a very detail bug-description that inlcluded kernel build
options, ipfwadm settings and a tcpdump session. Basically, this is all
exactly what I get. In addition, IP forwarding/masquerading is broken and
network speed (both ethernet and ppp) is very, very slow. I had to drop
back to 2.0.25. I don't have much more to say than "Yes, this is a
legitimate problem with 2.1.9+".
Thanks,
-bp
-- # B. James Phillippe # System Administrator <Terran.ORG> # <bryan@terran.org> # http://w3.terran.org/~bryan # Finger for PGP key # Member since 1.1.59