on 9-5-2008 4:51 PM Gordon Messmer spake the following:
Stephen Harris wrote:
Sounds like the remote server may actually be busy and the number of outstanding connections is reaching the listen() backlog queue, so the remote server isn't doing an accept() and so the three way handshake isn't completing.
That thought crossed my mind, too. However, it doesn't explain why the problem only affects new connections from Linux hosts. Also, I believe that the listen queue is per-port, and this problem affects all ports equally, including oddball ports used by the web server. I'm the only one connecting to those ports.
There are certainly differences between the SYN packets from Linux hosts and those from Windows. On Linux, I see a window size of 5840, and tcp options: MSS=1460, SACK permitted, timestamps, and window scale: 7.
On Windows, the window size is 65535, MSS=1460, and SACK permitted.
However, I have no idea why any of those differences would cause a problem intermittently.
Unless there is a router in between somewhere that is broken on its dealing with window scaling. I have had that problem in the past.