<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.10.1">
</HEAD>
<BODY>
On Wed, 2006-07-05 at 14:17 +0200, Roberto Ragusa wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
<FONT COLOR="#000000">Chris Linton-Ford wrote:</FONT>
<FONT COLOR="#000000">> Hi,</FONT>
<FONT COLOR="#000000">> </FONT>
<FONT COLOR="#000000">> I've had a recurring problem on our office network where some computers</FONT>
<FONT COLOR="#000000">> suddenly stop being able to access certain websites. We're currently</FONT>
<FONT COLOR="#000000">> using a mixture of FC3-5 behind an OpenBSD gateway, which performs</FONT>
<FONT COLOR="#000000">> firewalling and NAT; however we had the same problem when using an FC5</FONT>
<FONT COLOR="#000000">> gateway.</FONT>
<FONT COLOR="#000000">> </FONT>
<FONT COLOR="#000000">> The computer in question at the moment is running FC4, has no problems</FONT>
<FONT COLOR="#000000">> resolving the IP address of the website, and its routing tables are</FONT>
<FONT COLOR="#000000">> fine. It doesn't have a firewall, and can access all other websites no</FONT>
<FONT COLOR="#000000">> problems, as far as we can tell. Doing a tcpdump shows that the http</FONT>
<FONT COLOR="#000000">> packets are going out and ack packets are coming back, but no http data</FONT>
<FONT COLOR="#000000">> comes back from the website.</FONT>
<FONT COLOR="#000000">> </FONT>
<FONT COLOR="#000000">> I've tried accessing the website using Firefox, elinks and using telnet</FONT>
<FONT COLOR="#000000">> to do the basic GET /index.htm etc. They all hang after the sending the</FONT>
<FONT COLOR="#000000">> request.</FONT>
<FONT COLOR="#000000">Can you sniff the packets on the external interface of the gateway to</FONT>
<FONT COLOR="#000000">understand if something is blocked by the firewall on the gateway?</FONT>
<FONT COLOR="#000000">Some things I'd check:</FONT>
<FONT COLOR="#000000">1) "ifconfig eth0 mtu 1000" on the FC4 box to use smaller packets</FONT>
<FONT COLOR="#000000">2) "cat /proc/sys/net/ipv4/tcp_window_scaling"; if it is enabled,</FONT>
<FONT COLOR="#000000">try disabling it</FONT>
<FONT COLOR="#000000">3) "cat /proc/sys/net/ipv4/tcp_ecn" to see if ECN is enabled (better</FONT>
<FONT COLOR="#000000">if disabled, but it should be 0 by default)</FONT>
<FONT COLOR="#000000">Best regards.</FONT>
<FONT COLOR="#000000">-- </FONT>
<FONT COLOR="#000000"> Roberto Ragusa mail at robertoragusa.it</FONT>
</PRE>
</BLOCKQUOTE>
Hi Roberto,<BR>
<BR>
Changing the MTU size didn't help, but disabling tcp_window_scaling did the trick. Having looked around various groups, it sounds like this is a problem with the 2.6.17-1.2139 kernel; is it a better idea for me to permanently disable window scaling on our machines or wait until a fix comes out for the kernel? Is window scaling a Good Thing?<BR>
<BR>
Thanks for your help,<BR>
<BR>
Chris<BR>
<BR>
<BR>
</BODY>
</HTML>