Subject: Re: Problem with RFC 1323 and HP-UX

From: "Charles M. Hannum" <[email-masked]>
Date: Thu, 29 Oct 1998 07:49:34 -0500 (EST)

A user sent me the following tcpdump output, regarding a problem where
a connection between a machine running HP-UX (hp.rc.vix.com) and
NetBSD (xenon.rc.vix.com) would `freeze.'

It appears that the HP box is resetting its time stamp.  (Note that
the time stamp on the 00:19:25.226717 packet is `less than' the time
stamp on the 00:18:05.615634 packet.)  This causes the PAWS check to
fail on all future packets, and they are therefore dropped by the
NetBSD box after sending an ACK.

This would seem to be a bug in the HP-UX implementation of RFC 1323.
It looks to me like HP-UX is using a 16-bit counter and updating it
every .01s, whereas NetBSD is using a 32-bit counter and updating it
every .5s.  The granularity isn't really an issue, but it seems to me
that rolling over at 16 bits is clearly wrong.

For reference, the version of HP-UX in question is:

  HP-UX hpd280 B.11.00 A 9000/820 2006777451 two-user license

Could someone verify that I'm not on drugs here?

00:18:05.445911 hp.rc.vix.com.ssh > xenon.rc.vix.com.65534: P 124148:124240(92) ack 1668 win 32768 <nop,nop,timestamp 62691 204> [tos 0x10]
00:18:05.445998 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: . ack 124240 win 17428 <nop,nop,timestamp 811 62685> [tos 0x10]
00:18:05.589140 hp.rc.vix.com.ssh > xenon.rc.vix.com.65534: P 124240:124284(44) ack 1668 win 32768 <nop,nop,timestamp 62705 204> [tos 0x10]
00:18:05.615634 hp.rc.vix.com.ssh > xenon.rc.vix.com.65534: P 124284:124328(44) ack 1668 win 32768 <nop,nop,timestamp 62708 204> [tos 0x10]
00:18:05.615717 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: . ack 124328 win 17476 <nop,nop,timestamp 811 62705> [tos 0x10]
00:19:25.179785 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: P 1668:1688(20) ack 124328 win 17520 <nop,nop,timestamp 971 62705> [tos 0x10]
00:19:25.226717 hp.rc.vix.com.ssh > xenon.rc.vix.com.65534: P 124328:124364(36) ack 1688 win 32768 <nop,nop,timestamp 5133 971> [tos 0x10]
00:19:25.226806 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: . ack 124328 win 17520 <nop,nop,timestamp 971 62705> [tos 0x10]
00:19:25.736480 hp.rc.vix.com.ssh > xenon.rc.vix.com.65534: P 124328:124364(36) ack 1688 win 32768 <nop,nop,timestamp 5184 971> [tos 0x10]
00:19:25.736560 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: . ack 124328 win 17520 <nop,nop,timestamp 972 62705> [tos 0x10]
00:19:26.163664 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: P 1668:1688(20) ack 124328 win 17520 <nop,nop,timestamp 972 62705> [tos 0x10]
00:19:26.164082 hp.rc.vix.com.ssh > xenon.rc.vix.com.65534: . ack 1688 win 32768 <nop,nop,timestamp 5226 971> [tos 0x10]
00:19:26.164148 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: . ack 124328 win 17520 <nop,nop,timestamp 973 62705> [tos 0x10]
00:19:26.164600 hp.rc.vix.com.ssh > xenon.rc.vix.com.65534: P 124328:124364(36) ack 1688 win 32768 <nop,nop,timestamp 5226 971> [tos 0x10]
00:19:26.164662 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: . ack 124328 win 17520 <nop,nop,timestamp 973 62705> [tos 0x10]
00:19:26.686484 hp.rc.vix.com.ssh > xenon.rc.vix.com.65534: P 124328:124364(36) ack 1688 win 32768 <nop,nop,timestamp 5279 971> [tos 0x10]
00:19:26.686556 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: . ack 124328 win 17520 <nop,nop,timestamp 974 62705> [tos 0x10]
00:19:28.163663 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: P 1668:1688(20) ack 124328 win 17520 <nop,nop,timestamp 976 62705> [tos 0x10]
00:19:28.164080 hp.rc.vix.com.ssh > xenon.rc.vix.com.65534: . ack 1688 win 32768 <nop,nop,timestamp 5426 971> [tos 0x10]
00:19:28.164145 xenon.rc.vix.com.65534 > hp.rc.vix.com.ssh: . ack 124328 win 17520 <nop,nop,timestamp 977 62705> [tos 0x10]

---

From: William Gilliam <[email-masked]>
Date: Thu, 29 Oct 1998 09:13:46 -0800 (PST)

> NetBSD box after sending an ACK.

Yes, your user has hit an old bug that was fixed quite a while ago.

> Could someone verify that I'm not on drugs here?

I'll just say that your interpretation of the tcpdump output is correct.  I'll
also say that this problem was fixed shortly after HP-UX 11.0 was released,
so your customer should probably grab and install the appropriate patch
(the latest cumulative patch is PHNE_16645).

WG