LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 05-11-2005, 08:24 PM   #1
BigWillyStyle42
LQ Newbie
 
Registered: May 2005
Location: Ithaca, NY
Distribution: Debian
Posts: 2

Rep: Reputation: 0
TCP Connections stall through debian router


Recently certain TCP connections through my router have been stalling after the connection has been setup. i.e. the connection is established but neither side sends any data or so it appears.

This is most noticeable when I visit certain websites. Web traffic to servers on port 80 is routed through my squid cache and suffers no similar stalling. However https connections are not routed through my squid, and they are the best example of this problem.

If I try to direct my browser to webmail.cornell.edu (this will redirect to a secure website for login), I get so far as having the website's title displayed (CUWebLogin), and at that point the connection inexplicably stalls.

Netstat shows the connection as established:

Code:
netstat -an | grep 443
  TCP    192.168.1.100:2030     132.236.228.38:443     ESTABLISHED
I'm fairly certain that packets associated with these connections are not being dropped as they are placed in a specific htb class that has the highest priority with other interactive traffic, and looking at the stats for the class indicates it hasn't dropped any packets.

This issue occurs regardless of whether my upstream is saturated. I'd appreciate any suggestions you all have.


DSL connection with Verizon
3M/768K
 
Old 05-12-2005, 07:09 AM   #2
baldy3105
Member
 
Registered: Jan 2003
Location: Cambridgeshire, UK
Distribution: Mint (Desktop), Debian (Server)
Posts: 876

Rep: Reputation: 184Reputation: 184
Might be an MTU issue. If one device on the TCP path has a smaller mtu but ICMP Fragmentation messages are blocked by a firewall then TCP will establish but then fail due to being unable to throttle back to the smaller mtu. Check MTU's on all devices from your host to the internet routers outbound interface making sure all mtu's are 1500 and that you are not using tunnels anywhere.
 
Old 05-12-2005, 09:21 PM   #3
BigWillyStyle42
LQ Newbie
 
Registered: May 2005
Location: Ithaca, NY
Distribution: Debian
Posts: 2

Original Poster
Rep: Reputation: 0
Code:
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1452
Adding that to my firewall/traffic shaping script seems to have fixed everything, which would imply it was an MTU issue as you suggested. However I am still at a loss as to why it just suddenly stopped working.

Thanks for the tip.
 
Old 05-13-2005, 05:38 AM   #4
baldy3105
Member
 
Registered: Jan 2003
Location: Cambridgeshire, UK
Distribution: Mint (Desktop), Debian (Server)
Posts: 876

Rep: Reputation: 184Reputation: 184
No probs, MTU issues are getting more and more common now with the uptake of IPSec and GRE tunnels.

Be aware though that the MSS fix only works for TCP. If you have an app that sets Do-Not-Fragment on UDP or any other IP protocol it will suffer the same fate.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Need a way to limit TCP connections ewerta Linux - Networking 1 07-25-2005 03:54 PM
how to force kill TCP connections minil Programming 3 04-19-2005 06:04 AM
tune TCP stack for HTTP connections naijaguy Linux - General 0 02-01-2005 06:42 PM
half-open tcp connections r_m_carlsson Linux - Networking 1 02-03-2004 05:51 AM
How to limit the number of TCP connections for a certain port? mussons Linux - Security 1 01-28-2004 06:27 AM


All times are GMT -5. The time now is 06:16 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration