Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TCP connection timeout mystery

devnonsense.com

Post reply on HN
Print view View original

1–10 of 83 posts

Re: TCP connection timeout mystery

#3

Post by robertgraham »

My guess is that your original SYN did not go to the target, but was redirected somewhere close by. I'd look at the TTL value in the IP header of your first SYN-ACK, and play with such things as traceroute.

Such redirection is often done on a specific port basis, so that trying to access different ports might produce a different result, such as a RST packet coming back from port 1234 with a different TTL than port 443.

There is so much cheating going with Internet routing that the TTL is usually the first thing I check, to make sure things are what they claim.

Re: TCP connection timeout mystery

#4

Post by LinuxBender »

A raw packet capture would be useful to look deeper. Actually 2. One of the IP in question and one of any other site. Both from the problem source network. I would wager one of these things is not like the other but I need the .cap files as there is not enough information in the screenshot. The output of ss -emoian as text and not a screenshot may also be useful to grab just after the connections are attempted to both destinations.

Re: TCP connection timeout mystery

#7

Post by outsidein »

99% MTU size. Had this recently specifically with TLS due to large initial packets containing certificates. Results could even depend on user agent, some fail some will work.

try to reduce MTU on client, 1280 is a good starting point.

Re: TCP connection timeout mystery

#8

Post by fanf2 »

jsnell wrote: post #5
bediger4000 wrote: post #2

Clamp MSS to path MTU discovery?

I mean, yes, that was my instinctive response based on just the title. It's always the MTU. But in this case the packet that's being lost is a pure ACK.

Looks to me like the TLS client hello is being lost, which is why the server is sending duplicate SYN+ACKs.

Re: TCP connection timeout mystery

#9

Post by [deleted] »

outsidein wrote: post #7

99% MTU size. Had this recently specifically with TLS due to large initial packets containing certificates. Results could even depend on user agent, some fail some will work. try to reduce MTU on client, 1280 is a good starting point.

[deleted]
Post reply on HN