Bug 107890 - tcp sequence number error
Summary: tcp sequence number error
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: kernel
Version: 7.2
Hardware: i686
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Arjan van de Ven
QA Contact: Brian Brock
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2003-10-24 02:38 UTC by Dongluo Chen
Modified: 2016-11-10 07:10 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2003-12-17 01:24:45 UTC
Embargoed:

Attachments (Terms of Use)

Description Dongluo Chen 2003-10-24 02:38:09 UTC 
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)

Description of problem:
I am working on TCP analysis. I used tcpdump to monitor a TCP connection from a 
Red Hat Linux. The sequence captured by tcpdump is as follows, where 
192.168.1.12 is a Red Hat Linux 2.4.18-3bigmem. 

02:01:02.514466 192.168.1.12.80 > 202.204.14.33.1340: P 2571840263:2571841548
(1285) ack 2400822940 win 6432 (DF) (ttl 64, id 46064, len 1325)

02:01:02.731279 202.204.14.33.1340 > 192.168.1.12.80: . [tcp sum ok] 
2400822940:2400822940(0) ack 2571841548 win 0 (DF) (ttl 114, id 3561, len 40)

02:01:03.104191 192.168.1.12.80 > 202.204.14.33.1340: . [tcp sum ok] 
2571841547:2571841547(0) ack 2400822940 win 6432 (DF) (ttl 64, id 46065, len 40)

The problem is that in the second packet, sequence number 2571841548 is 
acknowledged by the remote peer. According to my understanding of  RFC793, TCP 
should increase SND.NXT to 2571841548. But in the third packet, Linux sends out 
a window-probing packet with sequence number 2571841547. I think it is not 
conformant to RFC793 and the remote peer would just discard this packet. I 
wonder if it is a bug in the TCP implementation. Or it is designed to do this 
for some purpose. 

Thank you.


Version-Release number of selected component (if applicable):
kernel-2.4.18-3

How reproducible:
Sometimes

Steps to Reproduce:
1.Monitor tcp connections with tcpdump. (It need some tool to confirm this kind 
of trace. To reproduce this problem, send window-probing packets to a red-hat 
linux and get its response. )
2.
3.
    

Actual Results:  the sequence number in a window-probing packet is less than 
SND.NXT

Expected Results: According to my understanding of RFC793, the sequence number 
in a window-probing packet is less than SND.NXT
Comment 1 Arjan van de Ven 2003-10-24 07:14:26 UTC 
You are using a very very old kernel which has been obsoleted by errata updates
many times, including kernels with tcp/ip fixes. Please verify that this is
fixed in the latest kernel erratum.
Comment 2 shichenghui 2016-11-06 04:25:52 UTC 
(In reply to Arjan van de Ven from comment #1)
> You are using a very very old kernel which has been obsoleted by errata
> updates
> many times, including kernels with tcp/ip fixes. Please verify that this is
> fixed in the latest kernel erratum.

hello, 
I also encountered this problem.when i do FTP download, it will be a random occurrence of this bug.It appears in the FTP control process.the tcp sequence number Minus 1 when Retransmission,but the content and size of the payload remains the same.
Please tell me is this a kernel of bug? Can you give me a detailed description of it.
I shall greatly appreciate your answering my questions.


No.     Time                          Source                Destination           Protocol Sequence number Next sequence number Acknowledgement number Info
  13774 2016-11-05 00:40:23.927084    203.146.249.195       10.172.240.250        FTP      234             281                  81                     Response: 229 Extended Passive Mode Entered (|||6446|).
  13775 2016-11-05 00:40:23.962554    10.172.240.250        203.146.249.195       FTP      81              95                   281                    Request: RETR 5MB.dat
  13776 2016-11-05 00:40:24.175095    203.146.249.195       10.172.240.250        FTP      233             280                  81                     [TCP Spurious Retransmission] Response: 229 Extended Passive Mode Entered (|||6446|).
  13777 2016-11-05 00:40:24.175617    10.172.240.250        203.146.249.195       TCP      95                                   281                    [TCP Dup ACK 13775#1] 41282→ftp(21) [ACK] Seq=95 Ack=281 Win=42496 Len=0 TSval=2102476 TSecr=2378302243 SLE=233 SRE=280
  13778 2016-11-05 00:40:24.255216    10.172.240.250        203.146.249.195       TCP      81              95                   281                    [TCP Retransmission] 41282→ftp(21) [PSH, ACK] Seq=81 Ack=281 Win=42496 Len=14 TSval=2102484 TSecr=2378302243
  13779 2016-11-05 00:40:24.555003    10.172.240.250        203.146.249.195       TCP      81              95                   281                    [TCP Retransmission] 41282→ftp(21) [PSH, ACK] Seq=81 Ack=281 Win=42496 Len=14 TSval=2102514 TSecr=2378302243
  13780 2016-11-05 00:40:24.657289    203.146.249.195       10.172.240.250        FTP      232             279                  81                     [TCP Spurious Retransmission] Response: 229 Extended Passive Mode Entered (|||6446|).
  13781 2016-11-05 00:40:24.657718    10.172.240.250        203.146.249.195       TCP      95                                   281                    [TCP Dup ACK 13775#2] 41282→ftp(21) [ACK] Seq=95 Ack=281 Win=42496 Len=0 TSval=2102524 TSecr=2378302243 SLE=232 SRE=279
  13782 2016-11-05 00:40:25.155131    10.172.240.250        203.146.249.195       TCP      81              95                   281                    [TCP Retransmission] 41282→ftp(21) [PSH, ACK] Seq=81 Ack=281 Win=42496 Len=14 TSval=2102574 TSecr=2378302243
  13783 2016-11-05 00:40:25.637025    203.146.249.195       10.172.240.250        FTP      231             278                  81                     [TCP Spurious Retransmission] Response: 229 Extended Passive Mode Entered (|||6446|).
  13784 2016-11-05 00:40:25.637660    10.172.240.250        203.146.249.195       TCP      95                                   281                    [TCP Dup ACK 13775#3] 41282→ftp(21) [ACK] Seq=95 Ack=281 Win=42496 Len=0 TSval=2102622 TSecr=2378302243 SLE=231 SRE=278
  13785 2016-11-05 00:40:26.355240    10.172.240.250        203.146.249.195       TCP      81              95                   281                    [TCP Retransmission] 41282→ftp(21) [PSH, ACK] Seq=81 Ack=281 Win=42496 Len=14 TSval=2102694 TSecr=2378302243
  13786 2016-11-05 00:40:27.591788    203.146.249.195       10.172.240.250        FTP      230             277                  81                     [TCP Spurious Retransmission] Response: 229 Extended Passive Mode Entered (|||6446|).
  13787 2016-11-05 00:40:27.592280    10.172.240.250        203.146.249.195       TCP      95                                   281                    [TCP Dup ACK 13775#4] 41282→ftp(21) [ACK] Seq=95 Ack=281 Win=42496 Len=0 TSval=2102817 TSecr=2378302243 SLE=230 SRE=277
  13788 2016-11-05 00:40:28.754602    10.172.240.250        203.146.249.195       TCP      81              95                   281                    [TCP Retransmission] 41282→ftp(21) [PSH, ACK] Seq=81 Ack=281 Win=42496 Len=14 TSval=2102934 TSecr=2378302243
  13789 2016-11-05 00:40:31.495609    203.146.249.195       10.172.240.250        FTP      229             276                  81                     [TCP Spurious Retransmission] Response: 229 Extended Passive Mode Entered (|||6446|).
  13790 2016-11-05 00:40:31.496148    10.172.240.250        203.146.249.195       TCP      95                                   281                    [TCP Dup ACK 13775#5] 41282→ftp(21) [ACK] Seq=95 Ack=281 Win=42496 Len=0 TSval=2103208 TSecr=2378302243 SLE=229 SRE=276
  13791 2016-11-05 00:40:33.565116    10.172.240.250        203.146.249.195       TCP      81              95                   281                    [TCP Retransmission] 41282→ftp(21) [PSH, ACK] Seq=81 Ack=281 Win=42496 Len=14 TSval=2103415 TSecr=2378302243
  13792 2016-11-05 00:40:39.305656    203.146.249.195       10.172.240.250        FTP      228             275                  81                     [TCP Spurious Retransmission] Response: 229 Extended Passive Mode Entered (|||6446|).
  13793 2016-11-05 00:40:39.306258    10.172.240.250        203.146.249.195       TCP      95                                   281                    [TCP Dup ACK 13775#6] 41282→ftp(21) [ACK] Seq=95 Ack=281 Win=42496 Len=0 TSval=2103989 TSecr=2378302243 SLE=228 SRE=275
  13794 2016-11-05 00:40:43.174971    10.172.240.250        203.146.249.195       TCP      81              95                   281                    [TCP Retransmission] 41282→ftp(21) [PSH, ACK] Seq=81 Ack=281 Win=42496 Len=14 TSval=2104376 TSecr=2378302243
  13795 2016-11-05 00:40:56.745965    203.146.249.195       10.172.240.250        FTP      227             274                  81                     [TCP Spurious Retransmission] Response: 229 Extended Passive Mode Entered (|||6446|).
  13796 2016-11-05 00:40:56.746454    10.172.240.250        203.146.249.195       TCP      95                                   281                    [TCP Dup ACK 13775#7] 41282→ftp(21) [ACK] Seq=95 Ack=281 Win=42496 Len=0 TSval=2105733 TSecr=2378302243 SLE=227 SRE=274
  13797 2016-11-05 00:41:02.415137    10.172.240.250        203.146.249.195       TCP      81              95                   281                    [TCP Retransmission] 41282→ftp(21) [PSH, ACK] Seq=81 Ack=281 Win=42496 Len=14 TSval=2106300 TSecr=2378302243
  13798 2016-11-05 00:41:26.893959    203.146.249.195       10.172.240.250        FTP      226             273                  81                     [TCP Spurious Retransmission] Response: 229 Extended Passive Mode Entered (|||6446|).
  13799 2016-11-05 00:41:26.894620    10.172.240.250        203.146.249.195       TCP      95                                   281                    [TCP Dup ACK 13775#8] 41282→ftp(21) [ACK] Seq=95 Ack=281 Win=42496 Len=0 TSval=2108748 TSecr=2378302243 SLE=226 SRE=273
  13800 2016-11-05 00:41:40.854869    10.172.240.250        203.146.249.195       TCP      81              95                   281                    [TCP Retransmission] 41282→ftp(21) [PSH, ACK] Seq=81 Ack=281 Win=42496 Len=14 TSval=2110144 TSecr=2378302243
  13801 2016-11-05 00:42:29.525131    203.146.249.195       10.172.240.250        FTP      225             272                  81                     [TCP Spurious Retransmission] Response: 229 Extended Passive Mode Entered (|||6446|).
  13802 2016-11-05 00:42:29.525884    10.172.240.250        203.146.249.195       TCP      95                                   281                    [TCP Dup ACK 13775#9] 41282→ftp(21) [ACK] Seq=95 Ack=281 Win=42496 Len=0 TSval=2115011 TSecr=2378302243 SLE=225 SRE=272
Comment 3 shichenghui 2016-11-10 07:09:23 UTC 
(In reply to Arjan van de Ven from comment #1)
> You are using a very very old kernel which has been obsoleted by errata
> updates
> many times, including kernels with tcp/ip fixes. Please verify that this is
> fixed in the latest kernel erratum.
Hi,Mr sir
Can you give me a detailed description of it.
I shall greatly appreciate your answering my questions.
Comment 4 shichenghui 2016-11-10 07:10:27 UTC 
(In reply to Arjan van de Ven from comment #1)
> You are using a very very old kernel which has been obsoleted by errata
> updates
> many times, including kernels with tcp/ip fixes. Please verify that this is
> fixed in the latest kernel erratum.
Hi,Mr sir
Can you give me a detailed description of it.
I shall greatly appreciate your answering my questions.
Note You need to log in before you can comment on or make changes to this bug.