Subject: Re: Question on initial sequence numbers

From: Vernon Schryver <[email-masked]>
Date: Mon, 4 Jan 1999 16:16:57 -0700 (MST)

> From: David Borman <[email-masked]>
> To: [email-masked], [email-masked]
> Cc: [email-masked]

> > ...
> > As far as I can see, there would be no problem (other than cost) with what
> > Microsoft is alledged to be doing if they guarantee that all initial
> > sequence numbers are "sufficently far apart."   "Smaller" is as good as
> > "larger", provided the delta is large enough so the probability of

> ...
> Well, I wouldn't say "no problem".  What I see at issue is that many
> TCP implementations (such as BSD) will allow a connection in TIME-WAIT to
> be reused before the TIME-WAIT has expired, if the incoming SYN has an ISS
> that is greater than the FIN from the previous instance of the connection.
> Otherwise, since there is no ACK bit, the SYN and any retranmissions of the
> SYN will be silently dropped until the TIME-WAIT state expires.
>
> So, for a TCP that generates random ISS values, when quickly re-using a
> TCP connection, they are going to have a 50/50 chance of the connection
> either being quickly established, or hung up doing SYN retransmissions until
> the TIME-WAIT connection on the server goes away or the client gives up on
> its SYN retransmissions.

That's a good point.

What is the political odor of that BSD feature in the IETF today?

> Of course, one problem is that since most TCPs destroy the PCB after
> getting the FIN in LAST-ACK state, if they immediatly reuse the
> connection they have no idea what the last sequence number used was.
> So the new ISS is just the standard ISS increment, and if the previous
> connection transfered more data than the delta between the ISSs, the
> ISS on the new SYN won't pass the TIME-WAIT check...

Both this problem and your other point apply only if the same
(addr,port,addr,port) 4-tuple is used, right?

In both problems, isn't the worst case a TIME-WAIT delay, and not the data
corruption of the likely implementation of the alledged random Microsoft
ISS's?   Of course, over the years we've each heard vastly more complaints
about TIME-WAIT delays than about data corruption, and never mind validity.

How likely is the re-use of a 4-tuple today?  In ancient days, wasn't it
fairly unlikely because hosts had enough state to keep the client end of
a connection in TIME-WAIT?  Reboot-every-few-minutes DOS hurt that
protection, but current Microsoft systems don't like unscheduled rebooting
and simply don't reboot quickly.  (A 300 MHz PII WIN95 w/fast disks of my
acquantance wants about 100 seconds if it doesn't insist on running chkdisk,
and lots more if it does.  Don't ask about the agility of the 33 MHz 486
NT system I use.  Redhat 5.2 Linux is worse.)  On the fifth hand, dynamic
PPP IP addresses could mean that some 4-tuples are rather popular.

Vernon Schryver    [email-masked]

---

From: Kacheong Poon <[email-masked]>
Date: Mon, 4 Jan 1999 15:41:53 -0800 (PST)

> about TIME-WAIT delays than about data corruption, and never mind validity.

I guess the reason is that most implementations' ISN go forward instead of
backward a little bit as described in the original mail about MS stack.  Going
forward a little bit in sequence number space is better in protecting against
sequence number collision than going backward a little bit, which is
equivalent to going forward too much.

							K. Poon.
							[email-masked]