Send SYN ACK from server ?

Hello,

I am seeing a problem where when a linux box from behind a linux
firewall connects to an external server, the external server is sending a second SYN,ACK message:

-> SYN sent
<- SYN,ACK received -- WINDOWS SIZE SET TO 0 ??
-> ACK sent

Then the external server sends:
<-SYN, ACK with same seq numbers ?? and WINDOW SIZE SET TO 16560 ??

Now if the client is windows :( it replies to the second SYN,ACK and everything seems to work, however when the client is linux, the second SYN,ACK is ignored by the client which I believe causes the connection state to be destroyed on the firewall.

Am I corrent is assuming that the window size update packet should NOT have the SYN bit set and that this is a problem on the remote server ?

Michael

Michael Gale

Linux Administrator
Network Administrator
Pason Systems Corp.

Hello,

Why does disabling TCP window tracking resolve this issue ?

The firewall is CentOS 4 - kernel Linux fw1-calgary.int.pason.com 2.6.9-22.0.1.EL #1 Thu Oct 27 12:26:11 iptables 1.2.11

# echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal

Michael

Michael Gale

Linux Administrator
Network Administrator
Pason Systems Corp.