tcp messages

[Vipul Ramani]

hi Smith,
 This is problem someone is running some sort of "tar-pit" system that is 
designed to keep sockets in a bad state and run you out of kernel memory.

RFC793 describes the correct behaviors here:

The mechanisms provided allow a TCP to advertise a large window and to 
subsequently advertise a much smaller window without having accepted that 
much data. This, so called "shrinking the window," is
strongly discouraged. The robustness principle dictates that TCPs will not 
shrink the window themselves, but will be prepared for such behavior on the 
part of other TCPs.

The sending TCP must be prepared to accept from the user and send at least 
one octet of new data even if the send window is zero. The sending TCP must 
regularly retransmit to the receiving TCP even when
the window is zero. Two minutes is recommended for the retransmission 
interval when the window is zero. This retransmission is essential to 
guarantee that when either TCP has a
zero window the re-opening of the window will be reliably reported to the 
other.

When the receiving TCP has a zero window and a segment arrives it must still 
send an acknowledgment showing its next expected sequence number and current 
window (zero).
 
V
On 6/6/05, DBSMITH at ohiohealth.com <DBSMITH at ohiohealth.com> wrote:

> Has anyone seen or know what these messages from dmesg are? Is there
> something that needs adjusted...aka window size?
> 
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/35691<http://172.25.131.224:515/35691>shrinks window
> 4136994921:
> 4136996381. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/35696<http://172.25.131.224:515/35696>shrinks window
> 4169121581:
> 4169123041. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/35696<http://172.25.131.224:515/35696>shrinks window
> 4169121581:
> 4169123041. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/35697<http://172.25.131.224:515/35697>shrinks window
> 4174644883:
> 4174646343. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/35697<http://172.25.131.224:515/35697>shrinks window
> 4174669703:
> 4174671163. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/35697<http://172.25.131.224:515/35697>shrinks window
> 4174669703:
> 4174671163. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/38385<http://172.25.131.224:515/38385>shrinks window
> 1327521259:
> 1327522719. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/38385<http://172.25.131.224:515/38385>shrinks window
> 1327521259:
> 1327522719. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/38385<http://172.25.131.224:515/38385>shrinks window
> 1327532939:
> 1327534399. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/38388<http://172.25.131.224:515/38388>shrinks window
> 1347341800:
> 1347343260. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/38388<http://172.25.131.224:515/38388>shrinks window
> 1347352020:
> 1347353480. Repaired.
> 
> TCP: Treason uncloaked! Peer 172.25.131.224:515/38388<http://172.25.131.224:515/38388>shrinks window
> 1347352020:
> 1347353480. Repaired.
> 
> 
> Derek B. Smith
> OhioHealth IT
> UNIX / TSM / EDM Teams
> 614-566-4145
> 
> --
> redhat-list mailing list
> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/redhat-list
> 



-- 
Vipul Ramani
linux2000in at gmail.com
linux2000in at yahoo.com
~~~~~We Know HOW NetWorkS ~~~~~