NOPs in TCP traffic

Mon Jul 12 09:44:00 UTC 2004

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi folks -

Tracking Fedora Development on this machine with the automated nightly yum 
updates.  Running kernel 2.6.7-1.478, but it has been the same for a week or 
two.

Problem is that some sites load like treacle.  For these site, you can see 
individual packets of text coming in about once a second or every few 
seconds.  Other sites are fine.

Here is a tcpdump of the bad behaviours, I notice a lot of nop,nop.nop 
actions, not sure how to interpret the TCP window sizes either.

10:35:00.689934 IP fastcat1.cb.ath.cx.33435 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1 win 45 <nop,nop,timestamp 
7052878 1017969034>
10:35:00.691408 IP fastcat1.cb.ath.cx.33435 > 
cache4-oxfd.server.ntli.net.webcache: P 1:587(586) ack 1 win 45 
<nop,nop,timestamp 7052880 1017969034>
10:35:00.708506 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33435: . ack 587 win 15798 <nop,nop,timestamp 1017969036 
7052880>
10:35:00.727144 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33435: P 1:1401(1400) ack 587 win 16384 <nop,nop,timestamp 
1017969038 7052880>
10:35:00.727215 IP fastcat1.cb.ath.cx.33435 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1401 win 65 <nop,nop,timestamp 
7052916 1017969038>
10:35:06.137328 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 846:987(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:35:06.137395 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 987 win 141 <nop,nop,timestamp 
7058327 1017948259>
10:35:10.729183 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33435: F 1401:1401(0) ack 587 win 16384 <nop,nop,timestamp 
1017970038 7052916>
10:35:10.768476 IP fastcat1.cb.ath.cx.33435 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1402 win 65 <nop,nop,timestamp 
7062959 1017970038>
10:35:11.606386 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 987:1128(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:35:11.606452 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1128 win 141 <nop,nop,timestamp 
7063797 1017948259>
10:35:11.611410 IP fastcat1.cb.ath.cx.33435 > 
cache4-oxfd.server.ntli.net.webcache: F 587:587(0) ack 1402 win 65 
<nop,nop,timestamp 7063802 1017970038>
10:35:11.611801 IP fastcat1.cb.ath.cx.33436 > 
cache4-oxfd.server.ntli.net.webcache: S 511096355:511096355(0) win 5840 <mss 
1460,sackOK,timestamp 7063802 0,nop,wscale 7>
10:35:11.622934 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33435: . ack 588 win 16384 <nop,nop,timestamp 1017970127 
7063802>
10:35:11.627787 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33436: S 633190833:633190833(0) ack 511096356 win 8760 
<mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 1017970128 7063802>
10:35:11.627859 IP fastcat1.cb.ath.cx.33436 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1 win 45 <nop,nop,timestamp 
7063818 1017970128>
10:35:11.630171 IP fastcat1.cb.ath.cx.33436 > 
cache4-oxfd.server.ntli.net.webcache: P 1:583(582) ack 1 win 45 
<nop,nop,timestamp 7063820 1017970128>
10:35:11.644152 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33436: . ack 583 win 15802 <nop,nop,timestamp 1017970130 
7063820>
10:35:11.661815 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33436: P 1449:1751(302) ack 583 win 16384 
<nop,nop,timestamp 1017970131 7063820>
10:35:11.661886 IP fastcat1.cb.ath.cx.33436 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1 win 45 <nop,nop,timestamp 
7063852 1017970130,nop,nop,sack sack 1 {1449:1751} >
10:35:11.662626 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33436: . 1:1449(1448) ack 583 win 16384 <nop,nop,timestamp 
1017970131 7063820>
10:35:11.662658 IP fastcat1.cb.ath.cx.33436 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1751 win 67 <nop,nop,timestamp 
7063853 1017970131>
10:35:17.075042 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 1128:1269(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:35:17.075126 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1269 win 141 <nop,nop,timestamp 
7069266 1017948259>
10:35:21.665165 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33436: F 1751:1751(0) ack 583 win 16384 <nop,nop,timestamp 
1017971132 7063853>
10:35:21.704614 IP fastcat1.cb.ath.cx.33436 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1752 win 67 <nop,nop,timestamp 
7073897 1017971132>
10:35:22.544657 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 1269:1410(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:35:22.544722 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1410 win 141 <nop,nop,timestamp 
7074737 1017948259>
10:35:28.013860 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 1410:1551(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:35:28.013927 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1551 win 141 <nop,nop,timestamp 
7080207 1017948259>
10:35:33.482512 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 1551:1692(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:35:33.482579 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1692 win 141 <nop,nop,timestamp 
7085676 1017948259>
10:35:33.722905 IP fastcat1.cb.ath.cx.33436 > 
cache4-oxfd.server.ntli.net.webcache: F 583:583(0) ack 1752 win 67 
<nop,nop,timestamp 7085917 1017971132>
10:35:33.735953 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33436: . ack 584 win 16384 <nop,nop,timestamp 1017972339 
7085917>
10:35:38.951894 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 1692:1833(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:35:38.951961 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1833 win 141 <nop,nop,timestamp 
7091147 1017948259>
10:35:44.420090 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 1833:1974(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:35:44.420157 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 1974 win 141 <nop,nop,timestamp 
7096616 1017948259>
10:35:49.889778 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 1974:2115(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:35:49.889844 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 2115 win 141 <nop,nop,timestamp 
7102086 1017948259>
10:35:55.357924 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 2115:2256(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:35:55.358005 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 2256 win 141 <nop,nop,timestamp 
7107556 1017948259>
10:36:00.826987 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 2256:2397(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:36:00.827053 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 2397 win 141 <nop,nop,timestamp 
7113025 1017948259>
10:36:06.295913 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33418: . 2397:2538(141) ack 1 win 65535 
<nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>
10:36:06.295961 IP fastcat1.cb.ath.cx.33418 > 
cache4-oxfd.server.ntli.net.webcache: . ack 2538 win 141 <nop,nop,timestamp 
7118495 1017948259>
10:36:06.299696 IP fastcat1.cb.ath.cx.33437 > 
cache4-oxfd.server.ntli.net.webcache: S 555162417:555162417(0) win 5840 <mss 
1460,sackOK,timestamp 7118499 0,nop,wscale 7>
10:36:06.314991 IP cache4-oxfd.server.ntli.net.webcache > 
fastcat1.cb.ath.cx.33437: S 815105876:815105876(0) ack 555162418 win 8760 
<mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 1017975597 7118499>

My ISP runs a transparent webcache on port 80, in this example I set Firefox 
to use an explicit proxy on port 8080 instead.  But the behaviour is 
identical if I go out on port 80 and through the default webcache (different 
to the one shown in this example) instead.

Konqueror acts the same on this bad machine, it is not the browser.

However, if I use my vnc session to another machine here, and get it to load 
the URL in Konqueror, whoosh.  That is using the same IP and firewall and 
everything to go out, but still is running 2.6.7-1.437.

Any ideas or interpretations of the tcpdump data?

- -Andy

- -- 
Automatic actions for USB cameras, cardreaders, memory sticks, MP3 players
http://warmcat.com/usbautocam
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFA8l1gjKeDCxMJCTIRAimUAJsHU39UCRYfuOAv3EkBHe3hlKA7QACfeZrB
T1ZhiSVIUiz+a3FCGGWWcXE=
=ROdo
-----END PGP SIGNATURE-----