Dear forum users. I have a problem with networking that shows up with certain web sites and certain web servers on the Internet.

The description of the problem is that the side loads only to a certain extent and then none of the http continuation packets seems to get through the border router. Surfing the same sites from an older Linux box (RH7) works fine but all our new Fedora Core 4 boxes show the same symptoms.

I have tried a lot of different things. First of all, I am not really a newbie at this, I have worked a lot with Linux and networking and never really seen anything like this problem before. I have turned off tcp_ecn but it makes no difference what so ever. I have turned off tcp_pmtu_disc but that makes no difference at all.

There is no firewall activated on the machine, I have made sure by flushing all tables/chains. The strange thing is that this must be related to something new in the kernel since 2.2 which is the older kernel used on the RH7 box I administrate.

It is absolutely frustrating and I would appreciate any help at all. I am pretty sure that we have a broken border router here, but since all the windows boxen works fine it is difficult for me to pressure the IT guys in doing anything at all.

Please if you have any suggestions to try, let me know!

Best regards,
Ichimusai

Welcome to LQ.

Do all of the boxes the same type of network card? There could be a bug in the module you are using.

I have heard of some people having similar problems when ipv6 is enabled and they are only using ipv4. Are there any inet6 entries when you run ifconfig?

Thanks for the welcome, and thank you ever so much for trying to help me out with this dilemma, it is very much appreciated!

Here is my relevant ifconfig output

eth0 Link encap:Ethernet HWaddr 00:0B:CD:46:EB:C8
inet addr:126.1.24.26 Bcast:126.1.24.255 Mask:255.255.255.0
inet6 addr: fe80::20b:cdff:fe46:ebc8/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:105634 errors:0 dropped:0 overruns:0 frame:0
TX packets:22104 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:14768912 (14.0 MiB) TX bytes:2795004 (2.6 MiB)

Lo and behold, there IS IPv6 configured. So I tweaked the /etc/modprobe.conf adding the following:

alias net-pf-10 off
alias ipv6 off

Then restarted the whole lot (since I don't really know a better way of making the changes take effect) and as it came up the ifconfig output now shows:

eth0 Link encap:Ethernet HWaddr 00:0B:CD:46:EB:C8
inet addr:126.1.24.26 Bcast:126.1.24.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:191 errors:0 dropped:0 overruns:0 frame:0
TX packets:142 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:27189 (26.5 KiB) TX bytes:14933 (14.5 KiB)

This seems to have turned IPv6 off for the system (and I don't really need it either so no loss there).

However, the problem with loading certain web pages persists.

The boxes are not all the same and have quite varying hardware, but they all show the same symptoms for the same web pages. I have successfully installed FC4 on one Compaq nx5000 (hp) laptop, a couple of different desktop stations and a couple of my colleagues also run FC4 on their desktop machines (we do some embedded development on an embedded ARM platform so more and more are using FC4 computers).

Let me add some information to the problem description, this is the output of tethereal for one of those pages that do not load properly. It is the "clasohlson "site in sweden so using the http protocol put a "www" in front of it and tack "se" on the end to form the full address (I am hesitant to write the link here as it may be considered spamming).

126.1.24.26 is my machine, but the address used internally is NAT:ed before it reaches the Real World Internet, don't ask why the network guys decided to use this range instead of one of the lan address ranges available.

212.214.0.20 is the webserver hosting the aforementioned site and as we follow the flow of packets back and forth most of it looks pretty normal to me:

2.241107 126.1.24.26 -> 212.214.0.20 TCP 57992 > http [FIN, ACK] Seq=0 Ack=0 Win=2908 Len=0 TSV=471647 TSER=0
2.241438 212.214.0.20 -> 126.1.24.26 TCP http > 57992 [ACK] Seq=0 Ack=1 Win=17519 Len=0
2.249595 126.1.24.26 -> 212.214.0.20 TCP 57991 > http [FIN, ACK] Seq=0 Ack=0 Win=2908 Len=0 TSV=471656 TSER=0
2.249907 212.214.0.20 -> 126.1.24.26 TCP http > 57991 [ACK] Seq=0 Ack=1 Win=17519 Len=0
2.275032 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
2.275085 126.1.24.26 -> 212.214.0.20 TCP 57992 > http [RST] Seq=1 Ack=63811959 Win=0 Len=0
2.275096 212.214.0.20 -> 126.1.24.26 TCP http > 57992 [FIN, ACK] Seq=82 Ack=1 Win=17519 Len=0
2.275102 126.1.24.26 -> 212.214.0.20 TCP 57992 > http [RST] Seq=1 Ack=63811959 Win=0 Len=0
2.289884 126.1.24.26 -> 212.214.0.20 TCP 57994 > http [SYN] Seq=0 Ack=0 Win=5840 Len=0 MSS=1460 TSV=471696 TSER=0 WS=2
2.291853 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
2.291900 126.1.24.26 -> 212.214.0.20 TCP 57991 > http [RST] Seq=1 Ack=3732791686 Win=0 Len=0
2.323317 212.214.0.20 -> 126.1.24.26 TCP http > 57994 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=0 TSV=0 TSER=0
2.323494 126.1.24.26 -> 212.214.0.20 TCP 57994 > http [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=471730 TSER=0
2.391680 126.1.24.26 -> 212.214.0.20 HTTP GET / HTTP/1.1
2.392288 212.214.0.20 -> 126.1.24.26 TCP http > 57994 [ACK] Seq=1 Ack=474 Win=65062 Len=0
2.478545 212.214.0.20 -> 126.1.24.26 HTTP HTTP/1.1 200 OK (text/html)
2.478725 126.1.24.26 -> 212.214.0.20 TCP 57994 > http [ACK] Seq=474 Ack=1449 Win=8736 Len=0 TSV=471885 TSER=0
2.483021 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
2.483195 126.1.24.26 -> 212.214.0.20 TCP 57994 > http [ACK] Seq=474 Ack=2897 Win=11632 Len=0 TSV=471889 TSER=0
2.483209 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
2.483224 126.1.24.26 -> 212.214.0.20 TCP 57994 > http [ACK] Seq=474 Ack=2909 Win=11632 Len=0 TSV=471889 TSER=0
2.511358 126.1.24.26 -> 212.214.0.20 TCP 57995 > http [SYN] Seq=0 Ack=0 Win=5840 Len=0 MSS=1460 TSV=471917 TSER=0 WS=2
2.544362 212.214.0.20 -> 126.1.24.26 TCP http > 57995 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=0 TSV=0 TSER=0
2.544542 126.1.24.26 -> 212.214.0.20 TCP 57995 > http [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=471951 TSER=0
2.545307 126.1.24.26 -> 212.214.0.20 HTTP GET /shop/include/clasohlson.css HTTP/1.1
2.545856 212.214.0.20 -> 126.1.24.26 TCP http > 57995 [ACK] Seq=1 Ack=536 Win=65000 Len=0
2.593433 212.214.0.20 -> 126.1.24.26 HTTP HTTP/1.1 200 OK (text/css)
2.593588 126.1.24.26 -> 212.214.0.20 TCP 57995 > http [ACK] Seq=536 Ack=1449 Win=8736 Len=0 TSV=472000 TSER=0
2.598031 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
2.598136 126.1.24.26 -> 212.214.0.20 TCP 57995 > http [ACK] Seq=536 Ack=2897 Win=11632 Len=0 TSV=472004 TSER=0
2.598145 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
2.598155 126.1.24.26 -> 212.214.0.20 TCP 57995 > http [ACK] Seq=536 Ack=2909 Win=11632 Len=0 TSV=472004 TSER=0
4.957712 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
4.957784 126.1.24.26 -> 212.214.0.20 TCP 57994 > http [ACK] Seq=474 Ack=2910 Win=11632 Len=0 TSV=474364 TSER=0
5.068456 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
5.068525 126.1.24.26 -> 212.214.0.20 TCP 57995 > http [ACK] Seq=536 Ack=2910 Win=11632 Len=0 TSV=474475 TSER=0
9.988588 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
9.988648 126.1.24.26 -> 212.214.0.20 TCP 57994 > http [ACK] Seq=474 Ack=2911 Win=11632 Len=0 TSV=479396 TSER=0
10.098115 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
10.098183 126.1.24.26 -> 212.214.0.20 TCP 57995 > http [ACK] Seq=536 Ack=2911 Win=11632 Len=0 TSV=479505 TSER=0
17.849307 126.1.24.26 -> 212.214.0.20 TCP 57995 > http [FIN, ACK] Seq=536 Ack=2911 Win=11632 Len=0 TSV=487258 TSER=0
17.849376 126.1.24.26 -> 212.214.0.20 TCP 57994 > http [FIN, ACK] Seq=474 Ack=2911 Win=11632 Len=0 TSV=487258 TSER=0
17.849569 212.214.0.20 -> 126.1.24.26 TCP http > 57995 [ACK] Seq=2911 Ack=537 Win=65534 Len=0
17.849719 212.214.0.20 -> 126.1.24.26 TCP http > 57994 [ACK] Seq=2911 Ack=475 Win=65534 Len=0
17.883782 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
17.883863 126.1.24.26 -> 212.214.0.20 TCP 57995 > http [RST] Seq=537 Ack=404050813 Win=0 Len=0
17.883872 212.214.0.20 -> 126.1.24.26 TCP http > 57995 [FIN, ACK] Seq=2992 Ack=537 Win=65534 Len=0
17.883879 126.1.24.26 -> 212.214.0.20 TCP 57995 > http [RST] Seq=537 Ack=404050813 Win=0 Len=0
17.891933 212.214.0.20 -> 126.1.24.26 HTTP Continuation or non-HTTP traffic
17.892003 126.1.24.26 -> 212.214.0.20 TCP 57994 > http [RST] Seq=475 Ack=404317655 Win=0 Len=0

(some packets are edited out which are broadcast from windows boxen and other junk not related to this connection)

At this point however the webpage is only loaded to about 33-34% and the rest never arrives.

It is really really strange IMHO.

I would also like to add that every other network service I have tested seems to work fine (with the normal quirks you always end up with when you have NAT between you and the world), it is as far as I can tell only http which behaves this way and only some sites!

My own site, ichimusai with an org tacked on at the end works flawlessly for example. Many other sites do too. I estimate it to be somewhere around 1/5 - 1/3 of the tested commercial sites so far that shows this behaviour, so it is not specific for one server only.

I just can't get my head around what in the world is going on.

The laptop on which I also installed FC4 works perfectly if I bring it home. At home I have a VSDL connection that gives me an assymmetrical 9/12 Mbit connection and I have tried it directly connected to the net and through my NAT+firewall which I use to protect the gaming computers who runs BillOS.

Anything else you might think of which might affect this would be very helpful. I am getting slightly desperate here

Thanks in advance, once more it is very appreciated any help or assitance you may be able to offer in this matter.

Best wishes and thanks,
Ichimusai

It certainly seems odd if it is just http with the problem.

Are you using the same browser on all machines?
Have you tried using wget as a test:
wget http://www.somesite.com

Does it download the whole page?

It is really odd, innit?

Yes, I have tried a lot of different clients, my first thought was that it was some screwy proxy settings or something affecting this, but I have so far tried to use the following clients:

Mozilla
Firefox
Links
Wget

And they all give the same results on all the machines, so I don't think it is on the client level, or the interpretation of the incoming data in the clients. Granted that the mozilla and firefox browsers use the same engine in the background but Links and Wget usually get the job done where everyone else fails. But here it ends up just sitting there just like the rest of the clients I have tried.

I also telneted into the web server to try to find out what is going on, averything works fine until i get for the index.html and then it delivers about 30% of the page and then stops.

Cheers,
Ichimusai