<br><br>
<div><span class="gmail_quote">On 28/09/2007, <b class="gmail_sendername">Alain Spineux</b> <<a href="mailto:aspineux@gmail.com">aspineux@gmail.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Here are my own tcpdump, this is only the connection part.<br><a href="http://192.168.23.11">192.168.23.11
</a> is a centos4, .14 is a centos5 (2.6.18-8.el5xen)<br>Lines are grouped 2 by 2<br>I see two strenge things :<br>- the windows is only 46bytes large !<br>- the centos4 send a packed with a bad checksum!<br><br><br>21:10:
26.841544 IP (tos 0x10, ttl 64, id 31172, offset 0, flags [DF],<br>proto: TCP (6), length: 60) 192.168.23.14.36608 > 87.86.7.52.http: S,<br>cksum 0x53a4 (correct), 1955586986:1955586986(0) win 5840 <mss<br>1460,sackOK,timestamp 626170478 0,nop,wscale 7>
<br>21:07:46.854517 IP (tos 0x10, ttl 64, id 16300, offset 0, flags [DF],<br>proto 6 , length: 60) 192.168.23.11.33258 > 87.86.7.52.http: S<br>[tcp sum ok] 830506483:830506483(0) win 5840 <mss<br>
1460,sackOK,timestamp 2948184671 0,nop,wscale 2><br><br>21:10:26.884069 IP (tos 0x0, ttl 53, id 0, offset 0, flags [DF],<br>proto: TCP (6), length: 52) 87.86.7.52.http > 192.168.23.14.36608: S,<br>cksum 0xe891 (correct), 1450179434:1450179434(0) ack 1955586987 win
<br>5840 <mss 1460,nop,nop,sackOK,nop,wscale 0><br>21:07:46.881494 IP (tos 0x0, ttl 53, id 0, offset 0, flags [DF],<br>proto 6 , length: 52) 87.86.7.52.http > 192.168.23.11.33258: S<br>[tcp sum ok] 2040411689:2040411689(0) ack 830506484 win
<br>5840 <mss 1460,nop,nop,sackOK,nop,wscale 0><br><br>21:10:26.884120 IP (tos 0x10, ttl 64, id 31173, offset 0, flags [DF],<br>proto: TCP (6), length: 40) 192.168.23.14.36608 > 87.86.7.52.http: .,<br>cksum 0x3fff (correct), ack 1 win 46
<br>21:07:46.881575 IP (tos 0x10, ttl 64, id 16302, offset 0, flags [DF],<br>proto 6 , length: 40) 192.168.23.11.33258 > 87.86.7.52.http: .<br>[tcp sum ok] ack 1 win 1460<br><br>21:10:30.317344 IP (tos 0x10, ttl 64, id 31174, offset 0, flags [DF],
<br>proto: TCP (6), length: 47) 192.168.23.14.36608 > 87.86.7.52.http: P,<br>cksum 0x6b7d (correct), 1:8(7) ack 1 win 46<br>21:07:55.031547 IP (tos 0x10, ttl 64, id 16304, offset 0, flags [DF],<br>proto 6 , length: 47)
192.168.23.11.33258 > 87.86.7.52.http: P<br>[bad tcp cksum 365f (->b5e9)!] 1:8(7) ack 1 win 1460<br><br>21:10:30.363124 IP (tos 0x0, ttl 53, id 4389, offset 0, flags [DF],<br>proto: TCP (6), length: 40) 87.86.7.52.http
> 192.168.23.14.36608: .,<br>cksum 0x2956 (correct), ack 8 win 5840<br>21:07:55.054752 IP (tos 0x0, ttl 53, id 10784, offset 0, flags [DF],<br>proto 6 , length: 40) 87.86.7.52.http > 192.168.23.11.33258: .<br>
[tcp sum ok] ack 8 win 5840<br><br>21:11:15.504130 IP (tos 0x0, ttl 20, id 1, offset 0, flags [none],<br>proto: TCP (6), length: 40) 87.86.7.52.http > 192.168.23.14.36570:<br>R, cksum 0xa6df (correct), 235172837:235172837(0) ack 1829917834 win 0
<br>21:07:55.114216 IP (tos 0x0, ttl 53, id 10785, offset 0, flags [DF],<br>proto 6, length: 1500) 87.86.7.52.http > 192.168.23.11.33258: .<br>1:1461(1460) ack 8 win 5840<br><br><br><br><br>On 9/28/07, Alain Spineux <
<a href="mailto:aspineux@gmail.com">aspineux@gmail.com</a>> wrote:<br>> Ops<br>> I have the same at home :-)<br>> My Centos5 is not working too but my 4.x is working well !!!<br>><br>> I look like <a href="http://www.debtbusterloans.com">
www.debtbusterloans.com</a> return packet with bad checksum.<br>> Centos4 accept it, but Centos5 ignore it<br>><br>><br>> On 9/28/07, Alain Spineux <<a href="mailto:aspineux@gmail.com">aspineux@gmail.com</a>
> wrote:<br>> > Hi<br>> ><br>> > Are eagle and Mailscanner on the same network, on the same switch/hub ?<br>> > Can you post your tcpdump for both connection.<br>> > What is the NIC ?<br>
> ><br>> > On 9/27/07, Garron Kramer <<a href="mailto:garron.gmail@epidemic.co.za">garron.gmail@epidemic.co.za</a>> wrote:<br>> > > I seem to be having a problem with all of my CentOS5 machines, which do not
<br>> > > seem to be a problem with CentOS4.4:<br>> > ><br>> > > [garron@MailScanner ~]$ telnet <a href="http://www.debtbusterloans.com">www.debtbusterloans.com</a> 80<br>> > > Trying 87.86.7.52..
.<br>> > > Connected to <a href="http://www.debtbusterloans.com">www.debtbusterloans.com</a> (<a href="http://87.86.7.52">87.86.7.52</a>).<br>> > > Escape character is '^]'.<br>> > > GET /
<br>> > > HTTP/1.1 200 OK<br>> > > Date: Thu, 27 Sep 2007 10:34:24 GMT<br>> > > Server: Microsoft-IIS/6.0<br>> > > X-Powered-By: <a href="http://ASP.NET">ASP.NET</a><br>> > > X-AspNet-Version:
2.0.50727<br>> > > Pragma: no-cache<br>> > > ...<br>> > ><br>> > > Yet:<br>> > ><br>> > > [root@eagle ~]# telnet <a href="http://www.debtbusterloans.com">www.debtbusterloans.com
</a> 80<br>> > > Trying 87.86.7.52...<br>> > > Connected to <a href="http://www.debtbusterloans.com">www.debtbusterloans.com</a> (<a href="http://87.86.7.52">87.86.7.52</a>).<br>> > > Escape character is '^]'.
<br>> > > GET /<br>> > ><br>> > > Connection closed by foreign host.<br>> > > [root@eagle ~]#<br>> > ><br>> > > ---<br>> > ><br>> > > I've done a tcpdump, and it would appear as if I receive a TCP RST when
<br>> > > attempting to request pages - yet this appears to work for other websites.<br>> > ><br>> > > So far, I've been able to narrow down that this is only happening on my<br>> > > CentOS5 machines and not
CentOS4.4Server installations.<br>> > ><br>> > > Could anyone please advise? Its the strangest problem - especially as it<br>> > > only affects certain websites.<br>> > ><br>> > > Regards,
<br>> > > Garron Kramer<br>> > > _______________________________________________<br>> > > CentOS mailing list<br>> > > <a href="mailto:CentOS@centos.org">CentOS@centos.org</a><br>> > >
<a href="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</a><br>> > ><br>> > ><br>> ><br>> ><br>> > --<br>> > Alain Spineux<br>> > aspineux gmail com
<br>> > May the sources be with you<br>> ><br>><br>><br>> --<br>> Alain Spineux<br>> aspineux gmail com<br>> May the sources be with you<br>><br><br><br>--<br>Alain Spineux<br>aspineux gmail com
<br>May the sources be with you<br>_______________________________________________<br>CentOS mailing list<br><a href="mailto:CentOS@centos.org">CentOS@centos.org</a><br><a href="http://lists.centos.org/mailman/listinfo/centos">
http://lists.centos.org/mailman/listinfo/centos</a><br><br>--<br>This message has been scanned for viruses and<br>dangerous content by MailScanner, and is<br>believed to be clean.<br><br></blockquote></div>
<div><br>Alain,</div>
<div> </div>
<div>I'm seeing exactly the same issues as yourself.</div>
<div> </div>
<div>I've got multiple CentOS5 machines and CentOS4.4 machines in my office network - as well as CentOS4.4 and CentOS5 at home - I'm seeing exactly the same issues behind iptables and BSD PF NAT.</div>
<div> </div>
<div>I'm hoping someone will be able to suggest an answer - as my primary proxy server at the office is built on a CentOS5 machine.</div>
<div> </div>
<div>Re your TCPdump... I see exactly the same thing as yourself. TCP session opens successfully, but as soon as you request a page, the session is closed.</div>
<div> </div>
<div>Any ideas?</div>
<div> </div>
<div>Regards,</div>
<div>Garron</div>