From nobody Wed May 14 19:45:27 2025 X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZyP2t1tP7z5vftX for ; Wed, 14 May 2025 19:45:42 +0000 (UTC) (envelope-from email@nigge.ru) Received: from send82.i.mail.ru (send82.i.mail.ru [89.221.237.177]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4ZyP2r6wVdz3cp9 for ; Wed, 14 May 2025 19:45:40 +0000 (UTC) (envelope-from email@nigge.ru) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=nigge.ru header.s=mailru header.b=UPmmE3Sp; spf=pass (mx1.freebsd.org: domain of email@nigge.ru designates 89.221.237.177 as permitted sender) smtp.mailfrom=email@nigge.ru; dmarc=none DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nigge.ru; s=mailru; h=To:Date:Message-Id:Subject:Mime-Version:Content-Type:From:From: Sender:Reply-To:To:Cc:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive:X-Cloud-Ids: Disposition-Notification-To; bh=ADePdDQs98wFzqw98uEDkz5YR1d1MXGN6ymABOKBlz0=; t=1747251940; x=1747341940; b=UPmmE3SpU3r/NgseMbmBJOPR7i8WHxet2FvDHHEy2Vu4dpE i5peFlDDBqXXFwHhV08S2jgr/e4eIUMSmN432oDMOWi0oNbTG7bxPY2IzjgMXjlcsvZoevV66nu2g Lbwm037mgopVA8KR3oonl8gB6QrddcfwTrBKE7blq/9FquQ=; Received: by exim-smtp-7b66877447-x87lq with esmtpa (envelope-from ) id 1uFI2s-000000002rF-0hCB for freebsd-net@FreeBSD.org; Wed, 14 May 2025 22:45:38 +0300 From: Ivan Content-Type: multipart/mixed; boundary="Apple-Mail=_87AE5D09-5AF8-41E9-8322-BF3A6C359EDD" List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@FreeBSD.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.400.131.1.6\)) Subject: =?utf-8?Q?TCP_sends_9KB_segments_via_netgraph_tunnel_despite_MTU/?= =?utf-8?Q?MSS_=E2=80=94_TSO-related=3F?= Message-Id: <8E9DD050-7A06-474E-BEAA-3600C4B0E587@nigge.ru> Date: Wed, 14 May 2025 22:45:27 +0300 To: "freebsd-net@freebsd.org" X-Mailer: Apple Mail (2.3826.400.131.1.6) X-Mailru-Src: smtp X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD908BCBE83E15C9C15A4C64FF5B7A185310527C34CE1A9E019182A05F538085040561513EF43BD2F063DE06ABAFEAF6705BF58DC5523F8E477C3F3EAC8DF3C02F1ACA8F312C2F0F594 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7548C33FFD72831AFEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637F91103FA893F53AB8638F802B75D45FF914D58D5BE9E6BC1A93B80C6DEB9DEE97C6FB206A91F05B267D48F965BC2B2322E070BE324C7D3C415F8E9A78D28A519F6B57BC7E64490618DEB871D839B73339E8FC8737B5C2249D99FB7B2A39B4961CC7F00164DA146DAFE8445B8C89999729449624AB7ADAF37F6B57BC7E64490611E7FA7ABCAF51C92176DF2183F8FC7C028FC0C15DC2E66F28941B15DA834481F9449624AB7ADAF37BA3038C0950A5D3613377AFFFEAFD269176DF2183F8FC7C0333383368A6F7D0F7B076A6E789B0E97A8DF7F3B2552694AD5FFEEA1DED7F25D49FD398EE364050F0AC5B80A05675ACD45B9AC499A3C791CB3661434B16C20ACC84D3B47A649675FE827F84554CEF5019E625A9149C048EE33AC447995A7AD182BEBFE083D3B9BA73A03B725D353964B2FFDA4F57982C5F435872C767BF85DA227C277FBC8AE2E8BE0F7FC12A719E3B775ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C1DE0DAB: 0D63561A33F958A592B8683A0DEA55925002B1117B3ED696A22C13B13D5B4EC9406406D89DD9EB8A823CB91A9FED034534781492E4B8EEAD5973B86847D985D2C79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0ADBF74143AD284FC7177DD89D51EBB7742DC8270968E61249B1004E42C50DC4CA955A7F0CF078B5EC49A30900B95165D349379E7F8541B6C9AA8736B886254691A3481DA23F3E472C335CDAF9D7DAA4184FDD1AF3DBEF850D11D7E09C32AA3244CC217C78CD343111E77DD89D51EBB774270DB1A6407913A35EA455F16B58544A2C99F59F2F009F096E0FF54F70C9E02581C282AE7E73D2CB4320D709FF5904564 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVT0GoR8ZYDe7OKVdLtY51VM= X-Mailru-Sender: AF3B3D89626E9CAA665F7E468C1D8362262588ABDC3C5F1D3DE06ABAFEAF6705BF58DC5523F8E47787BBD21BC54961EB0F3205FF34CB04E7C77752E0C033A69E866814E7668C8BF9918FA55765BAAD5E371403701B8927720D4ABDE8C577C2ED X-Mras: Ok X-Rspamd-Queue-Id: 4ZyP2r6wVdz3cp9 X-Spamd-Bar: - X-Spamd-Result: default: False [-1.10 / 15.00]; SUBJECT_ENDS_QUESTION(1.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.997]; MV_CASE(0.50)[]; R_SPF_ALLOW(-0.20)[+ip4:89.221.237.128/25]; R_DKIM_ALLOW(-0.20)[nigge.ru:s=mailru]; NEURAL_HAM_LONG(-0.10)[-0.104]; MIME_GOOD(-0.10)[multipart/mixed,text/plain]; RCVD_VIA_SMTP_AUTH(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; RCVD_COUNT_ONE(0.00)[1]; ASN(0.00)[asn:47764, ipnet:89.221.236.0/22, country:RU]; MIME_TRACE(0.00)[0:+,1:+,2:+,3:+]; DMARC_NA(0.00)[nigge.ru]; HAS_ATTACHMENT(0.00)[]; ARC_NA(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; TO_DN_EQ_ADDR_ALL(0.00)[]; RCVD_TLS_LAST(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MLMMJ_DEST(0.00)[freebsd-net@FreeBSD.org]; DKIM_TRACE(0.00)[nigge.ru:+] --Apple-Mail=_87AE5D09-5AF8-41E9-8322-BF3A6C359EDD Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hello, I've been investigating a network issue that took quite some time to = trace. I still cannot reproduce it in a test environment, but it = consistently occurs on a specific FreeBSD server with a more complex = network configuration. Summary of the issue: =20 Under certain conditions, the system attempts to send TCP packets larger = than 9 KB through a netgraph-based tunnel with MTU 1472, even though MSS = was negotiated to 1400. This happens when the initial route is via the default uplink, but PF = then re-routes the packet via the netgraph tunnel using `route-to`. If = the traffic is routed through ng0 directly (without PF), the issue does = not occur. The problem also disappears if TSO is disabled on the uplink = NIC. System: FreeBSD 13.5-RELEASE releng/13.5-n259162-882b9f3f2218 GENERIC amd64 Interfaces: - Primary LAN interface (where disabling TSO fixes the problem): igb0, MTU 1500 =20 options=3D4e520bb - Internet uplink: onp, VLAN over igb0, MTU 1500 =20 options=3D4600003 - Netgraph tunnel: ng0, MTU 1472 =20 inet 10.10.0.1 =E2=86=92 10.10.0.2 PF rules used for re-routing: nat log(all) on onp inet from 10.10.0.1 to any tag NG -> (ng0) = round-robin pass out quick on onp route-to (ng0 10.10.0.2) inet all flags S/SA = keep state tagged NG Packet trace (via pflog during a POST request ~10KB to YouTube): 15:46:01.784956 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags [P.], = seq 597:9703, length 9106 15:46:01.785020 IP 127.0.0.1 > 10.10.0.1: ICMP 209.85.233.198 = unreachable - need to frag (mtu 1472) This shows the kernel trying to send a 9106-byte segment over a link = that clearly can't handle it. The MSS was already negotiated at 1400, so = this seems unexpected. The ICMP response is generated locally. The = result is segment loss, out-of-order retransmissions, and poor TLS = performance. I also reproduced this behavior with OpenVPN =E2=80=94 so the issue is = not netgraph-specific. Questions: - Is this expected behavior due to TSO interacting poorly with PF = route-to? - Should TSO respect the effective MTU based on the post-PF routing = decision? - Or is this a bug in the TCP offload path? Thanks in advance for any insights. --Apple-Mail=_87AE5D09-5AF8-41E9-8322-BF3A6C359EDD Content-Disposition: attachment; filename=pflog.txt Content-Type: text/plain; x-unix-mode=0644; name="pflog.txt" Content-Transfer-Encoding: quoted-printable 15:46:01.630576 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[S], seq = 2266960354, win 32768, options \[mss 1460,nop,wscale 7,sackOK,TS val = 1619341301 ecr 0], length 0 15:46:01.706085 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[S.], = seq 3704095926, ack 2266960355, win 65535, options \[mss 1400,sackOK,TS = val 3246736165 ecr 1619341301,nop,wscale 8], length 0 15:46:01.706120 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], ack = 3704095927, win 263, options \[nop,nop,TS val 1619341376 ecr = 3246736165], length 0 15:46:01.706736 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[P.], = seq 0:517, ack 1, win 263, options \[nop,nop,TS val 1619341377 ecr = 3246736165], length 517 15:46:01.781807 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 518, win 1048, options \[nop,nop,TS val 3246736241 ecr 1619341377], = length 0 15:46:01.782272 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], seq = 1:1389, ack 518, win 1050, options \[nop,nop,TS val 3246736242 ecr = 1619341377], length 1388 15:46:01.782902 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[P.], = seq 1389:2777, ack 518, win 1050, options \[nop,nop,TS val 3246736242 = ecr 1619341377], length 1388 15:46:01.782913 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], ack = 2777, win 252, options \[nop,nop,TS val 1619341453 ecr 3246736242], = length 0 15:46:01.782918 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], seq = 2777:4165, ack 518, win 1050, options \[nop,nop,TS val 3246736242 ecr = 1619341377], length 1388 15:46:01.783121 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[P.], = seq 4165:5330, ack 518, win 1050, options \[nop,nop,TS val 3246736242 = ecr 1619341377], length 1165 15:46:01.783132 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], ack = 5330, win 254, options \[nop,nop,TS val 1619341453 ecr 3246736242], = length 0 15:46:01.784246 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[P.], = seq 517:597, ack 5330, win 263, options \[nop,nop,TS val 1619341454 ecr = 3246736242], length 80 15:46:01.784956 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[P.], = seq 597:9703, ack 5330, win 263, options \[nop,nop,TS val 1619341455 ecr = 3246736242], length 9106 15:46:01.785020 IP 127.0.0.1 > 10.10.0.1: ICMP 209.85.233.198 = unreachable - need to frag (mtu 1472), length 576 15:46:01.859245 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[P.], = seq 5330:5978, ack 598, win 1050, options \[nop,nop,TS val 3246736319 = ecr 1619341454], length 648 15:46:01.859435 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[P.], = seq 9703:9734, ack 5978, win 263, options \[nop,nop,TS val 1619341529 = ecr 3246736319], length 31 15:46:01.934863 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 598, win 1050, options \[nop,nop,TS val 3246736394 ecr = 1619341454,nop,nop,sack 1 {9704:9735}], length 0 15:46:02.146317 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], seq = 597:1985, ack 5978, win 263, options \[nop,nop,TS val 1619341816 ecr = 3246736394], length 1388 15:46:02.221109 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 1986, win 1045, options \[nop,nop,TS val 3246736681 ecr = 1619341816,nop,nop,sack 1 {9704:9735}], length 0 15:46:02.221119 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], seq = 1985:4761, ack 5978, win 263, options \[nop,nop,TS val 1619341891 ecr = 3246736681], length 2776 15:46:02.221187 IP 127.0.0.1 > 10.10.0.1: ICMP 209.85.233.198 = unreachable - need to frag (mtu 1472), length 576 15:46:02.503383 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], seq = 1985:3373, ack 5978, win 263, options \[nop,nop,TS val 1619342173 ecr = 3246736681], length 1388 15:46:02.578316 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 3374, win 1040, options \[nop,nop,TS val 3246737038 ecr = 1619342173,nop,nop,sack 1 {9704:9735}], length 0 15:46:02.578345 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], seq = 3373:6149, ack 5978, win 263, options \[nop,nop,TS val 1619342248 ecr = 3246737038], length 2776 15:46:02.578394 IP 127.0.0.1 > 10.10.0.1: ICMP 209.85.233.198 = unreachable - need to frag (mtu 1472), length 576 15:46:02.856709 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], seq = 3373:4761, ack 5978, win 263, options \[nop,nop,TS val 1619342527 ecr = 3246737038], length 1388 15:46:02.931490 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 4762, win 1035, options \[nop,nop,TS val 3246737391 ecr = 1619342527,nop,nop,sack 1 {9704:9735}], length 0 15:46:02.931503 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], seq = 4761:7537, ack 5978, win 263, options \[nop,nop,TS val 1619342602 ecr = 3246737391], length 2776 15:46:02.931525 IP 127.0.0.1 > 10.10.0.1: ICMP 209.85.233.198 = unreachable - need to frag (mtu 1472), length 576 15:46:03.212023 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], seq = 4761:6149, ack 5978, win 263, options \[nop,nop,TS val 1619342882 ecr = 3246737391], length 1388 15:46:03.287577 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 6150, win 1030, options \[nop,nop,TS val 3246737747 ecr = 1619342882,nop,nop,sack 1 {9704:9735}], length 0 15:46:03.287589 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], seq = 6149:8925, ack 5978, win 263, options \[nop,nop,TS val 1619342958 ecr = 3246737747], length 2776 15:46:03.287613 IP 127.0.0.1 > 10.10.0.1: ICMP 209.85.233.198 = unreachable - need to frag (mtu 1472), length 576 15:46:03.567171 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], seq = 6149:7537, ack 5978, win 263, options \[nop,nop,TS val 1619343237 ecr = 3246737747], length 1388 15:46:03.642204 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 7538, win 1025, options \[nop,nop,TS val 3246738102 ecr = 1619343237,nop,nop,sack 1 {9704:9735}], length 0 15:46:03.642216 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[P.], = seq 7537:9734, ack 5978, win 263, options \[nop,nop,TS val 1619343312 = ecr 3246738102], length 2197 15:46:03.642238 IP 127.0.0.1 > 10.10.0.1: ICMP 209.85.233.198 = unreachable - need to frag (mtu 1472), length 576 15:46:03.923035 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], seq = 7537:8925, ack 5978, win 263, options \[nop,nop,TS val 1619343593 ecr = 3246738102], length 1388 15:46:03.998014 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 8926, win 1020, options \[nop,nop,TS val 3246738457 ecr = 1619343593,nop,nop,sack 1 {9704:9735}], length 0 15:46:03.998030 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[P.], = seq 8925:9734, ack 5978, win 263, options \[nop,nop,TS val 1619343668 = ecr 3246738457], length 809 15:46:04.073766 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 9735, win 1017, options \[nop,nop,TS val 3246738533 ecr = 1619343668,nop,nop,sack 1 {9704:9735}], length 0 15:46:04.074310 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[P.], = seq 5978:6009, ack 9735, win 1017, options \[nop,nop,TS val 3246738534 = ecr 1619343668], length 31 15:46:04.113500 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], ack = 6009, win 263, options \[nop,nop,TS val 1619343784 ecr 3246738534], = length 0 15:46:04.170212 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[P.], = seq 6009:6259, ack 9735, win 1017, options \[nop,nop,TS val 3246738630 = ecr 1619343668], length 250 15:46:04.170238 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[P.], = seq 6259:7647, ack 9735, win 1017, options \[nop,nop,TS val 3246738630 = ecr 1619343668], length 1388 15:46:04.170253 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], ack = 7647, win 251, options \[nop,nop,TS val 1619343840 ecr 3246738630], = length 0 15:46:04.170256 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[P.], = seq 7647:9035, ack 9735, win 1017, options \[nop,nop,TS val 3246738630 = ecr 1619343668], length 1388 15:46:04.170461 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[P.], = seq 9734:9769, ack 9035, win 263, options \[nop,nop,TS val 1619343840 = ecr 3246738630], length 35 15:46:04.170837 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], seq = 9035:10423, ack 9735, win 1017, options \[nop,nop,TS val 3246738630 ecr = 1619343668], length 1388 15:46:04.170872 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[P.], = seq 10423:10988, ack 9735, win 1017, options \[nop,nop,TS val 3246738630 = ecr 1619343668], length 565 15:46:04.170876 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[.], ack = 10988, win 248, options \[nop,nop,TS val 1619343841 ecr 3246738630], = length 0 15:46:04.171286 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[P.], = seq 9769:9817, ack 10988, win 263, options \[nop,nop,TS val 1619343841 = ecr 3246738630], length 48 15:46:04.171317 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[P.], = seq 9817:9841, ack 10988, win 263, options \[nop,nop,TS val 1619343841 = ecr 3246738630], length 24 15:46:04.171436 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[F.], = seq 9841, ack 10988, win 263, options \[nop,nop,TS val 1619343841 ecr = 3246738630], length 0 15:46:04.172737 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[P.], = seq 10988:11027, ack 9735, win 1017, options \[nop,nop,TS val 3246738632 = ecr 1619343668], length 39 15:46:04.172748 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[R], seq = 2266970089, win 0, length 0 15:46:04.246038 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 9818, win 1017, options \[nop,nop,TS val 3246738706 ecr 1619343840], = length 0 15:46:04.246104 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[R], seq = 2266970172, win 0, length 0 15:46:04.246726 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[F.], = seq 11027, ack 9842, win 1017, options \[nop,nop,TS val 3246738706 ecr = 1619343841], length 0 15:46:04.246731 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[R], seq = 2266970196, win 0, length 0 15:46:04.246735 IP 209.85.233.198.443 > 10.10.0.1.63736: Flags \[.], ack = 9843, win 1017, options \[nop,nop,TS val 3246738706 ecr 1619343841], = length 0 15:46:04.246736 IP 10.10.0.1.62031 > 209.85.233.198.443: Flags \[R], seq = 2266970197, win 0, length 0 --Apple-Mail=_87AE5D09-5AF8-41E9-8322-BF3A6C359EDD Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --Apple-Mail=_87AE5D09-5AF8-41E9-8322-BF3A6C359EDD--