Re: "Greased TCPenguin"

Scott Lampert (fortunato@heavymetal.org)
Thu, 26 Mar 1998 07:30:39 -0500 (EST)


On 26-Mar-98 Trevor Johnson wrote:
> With an internal v.34 modem, I get a few of those errors:
>
> Dec 4 16:53:59 dennis1 kernel: TCPv4 bad checksum from
> 207.219.98.1:d9aa
> to 155.135.1.24:0014, len=24/24/44
> Dec 5 01:18:44 dennis1 kernel: TCPv4 bad checksum from
> 209.67.19.99:0050
> to 155.135.1.24:51b0, len=20/20/40
> Dec 5 01:18:57 dennis1 kernel: TCPv4 bad checksum from
> 209.67.19.99:0050
> to 155.135.1.24:51b9, len=20/20/40
> Dec 5 01:21:00 dennis1 kernel: TCPv4 bad checksum from
> 209.67.19.99:0050
> to 155.135.1.24:5259, len=20/20/40
> Dec 14 15:05:16 dennis1 kernel: TCPv4 bad checksum from
> 204.181.3.203:0050
> to 155.135.1.29:086b, len=874/874/894
> Dec 14 15:05:45 dennis1 kernel: TCPv4 bad checksum from
> 204.181.3.203:0050
> to 155.135.1.29:086d, len=1165/1165/1185
> Dec 31 13:58:32 dennis1 kernel: TCPv4 bad checksum from
> 206.184.214.34:0014 to 155.135.1.22:0831, len=1480/1480/1500
> Dec 31 14:45:03 dennis1 kernel: TCPv4 bad checksum from
> 206.184.214.34:0014 to 155.135.1.22:0832, len=1480/1480/1500
> Mar 25 23:41:58 dennis1 kernel: TCPv4 bad checksum from
> 208.147.140.18:0017 to 155.135.1.35:08b6, len=20/20/40
>
> I'm using ppp 2.3.3, a 2.1.72 kernel, and glibc 2.0.6. On the other end
> of the PPP connection is an Intel v.34 modem and a Cisco 7000
> communications server.

I'm getting lots of these:

Mar 26 00:56:34 altair kernel: <7>TCPv4 bad checksum from
208.131.128.6:0016 to 205.138.63.5:0470, len=532/532/552
Mar 26 00:57:12 altair last message repeated 85 times
Mar 26 00:57:58 altair last message repeated 73 times

In every instance the digits after len= are different, a quick perusal
shows 20/20/40, 40/40/60, 1480/1480/1500. I wonder if 20 is significant? :)

I'm running on an ethernet network with 2.1.91-pre1, glibc 2.0.7
and a Kingston DEC21041 based ethernet card. Hope this helps someone.
-Scott

---
Scott Lampert              | Home Page: http://www.heavymetal.org
<fortunato@heavymetal.org> | PGP Key: finger fortunato@heavymetal.org
"Black holes are where God +-----------------------------------------
   divided by zero."

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu