SACK (and PF) wierdness

Daniel Hartmeier daniel at
Mon Nov 22 13:18:55 GMT 2004

Pawel, could you provide a tcpdump -nvvvSXpi <if> for an entire
connection, from handshake to the point where it stalls? Please include
the corresponding 'BAD state'/'State failure' messages and output of
pfctl -vvss related to the connection (ideally all for the same
connection, so timestamps are comparable).

If the output is too long to post here, put it on a web server and post
the URL, or mail the dump to Max and me privately.

It does look like one peer is violating the other's window by sending
too much data before acknowledgement. The state has picked up on the
window scaling, so we need to see the entire TCP connection to determine
whether the packet is dropped correctly or not.


More information about the freebsd-net mailing list