Subject: ISN numbers and TIME_WAIT

From: [email-masked]
Date: Sat, 27 Mar 1999 15:43:33 -0800 (PST)

Hi folks,

This is a constantly recurring theme on the tcpimpl mailing list but the
solution seems to be elusive or divided among vendors. I have collected
some snoop traces from some of the TCP sessions between Irix, SunOS, Linux
and NT SP4.  This investigations were part of a bug that I was looking at
involving Irix and NT SP4. The test case involved running a remote rsh
command from a NT PC running SP4 to connect to a SGI Indy running
6.5.x. The command used to run on the client machines involved

rsh <remote-hostname> -l guest ls

Rsh uses a reserved port and not the ephemeral port for initiating the
connection. This sometimes leads to reuse of the same port number when the
command is re-issued. This might result in the remote TCP server getting a
SYN packet while in the midst of 2MSL timeout in the TIME_WAIT state. It
is also assumed that so long as the ISN number is monotonically increasing
(as specified in RFC 793), it is okay for the client to send another SYN
packet to the remote host to initiate another connection. However, the
behavior of the NT SP4 stack appears to not honor this "MUST"
requirement. I have collected snoop traces in which the SYN is sent to a
port in TIME_WAIT with a ISN number that is lower than what was used for
the previous connection. 

qepc-miles ---> NT client executing the rsh command

vinayb---> Indy running Irix 6.5.x acting as the remote server

Here is a excerpt of the snoop.

________________________________
 20   0.124234       vinayb -> qepc-miles   ETHER Type=0800 (IP), size =
128 bytes
 20   0.124234       vinayb -> qepc-miles   IP  D=192.82.162.65
S=150.166.75.35 LEN=114, ID=6923
 20   0.124234       vinayb -> qepc-miles   TCP D=1023 S=514 Fin Ack=40086
Seq=1227531872 Len=74 Win=61320
 20   0.124234       vinayb -> qepc-miles   RSHELL R port=1023
Desktop\ndumpster\ngue
________________________________
 21   0.000657       vinayb -> qepc-miles   ETHER Type=0800 (IP), size =
54 bytes
 21   0.000657       vinayb -> qepc-miles   IP  D=192.82.162.65
S=150.166.75.35 LEN=40, ID=6924
 21   0.000657       vinayb -> qepc-miles   TCP D=1022 S=1023 Fin
Ack=40058 Seq=1227593920 Len=0 Win=61320
________________________________
 22   0.002294   qepc-miles -> vinayb       ETHER Type=0800 (IP), size =
60 bytes
 22   0.002294   qepc-miles -> vinayb       IP  D=150.166.75.35
S=192.82.162.65 LEN=40, ID=32012
 22   0.002294   qepc-miles -> vinayb       TCP D=514 S=1023
Ack=1227531947 Seq=40086 Len=0 Win=8685
 22   0.002294   qepc-miles -> vinayb       RSHELL C port=1023
________________________________
 23   0.000047   qepc-miles -> vinayb       ETHER Type=0800 (IP), size =
60 bytes
 23   0.000047   qepc-miles -> vinayb       IP  D=150.166.75.35
S=192.82.162.65 LEN=40, ID=32268
 23   0.000047   qepc-miles -> vinayb       TCP D=1023 S=1022
Ack=1227593921 Seq=40058 Len=0 Win=8760
________________________________
 24   0.000522   qepc-miles -> vinayb       ETHER Type=0800 (IP), size =
60 bytes
 24   0.000522   qepc-miles -> vinayb       IP  D=150.166.75.35
S=192.82.162.65 LEN=40, ID=32524
 24   0.000522   qepc-miles -> vinayb       TCP D=514 S=1023 Fin
Ack=1227531947 Seq=40086 Len=0 Win=8685
 24   0.000522   qepc-miles -> vinayb       RSHELL C port=1023
________________________________
 25   0.000107   qepc-miles -> vinayb       ETHER Type=0800 (IP), size =
60 bytes
 25   0.000107   qepc-miles -> vinayb       IP  D=150.166.75.35
S=192.82.162.65 LEN=40, ID=32780
 25   0.000107   qepc-miles -> vinayb       TCP D=1023 S=1022 Fin
Ack=1227593921 Seq=40058 Len=0 Win=8760
________________________________
 26   0.000187       vinayb -> qepc-miles   ETHER Type=0800 (IP), size =
54 bytes
 26   0.000187       vinayb -> qepc-miles   IP  D=192.82.162.65
S=150.166.75.35 LEN=40, ID=6925
 26   0.000187       vinayb -> qepc-miles   TCP D=1023 S=514     Ack=40087
Seq=1227531947 Len=0 Win=61320
 26   0.000187       vinayb -> qepc-miles   RSHELL R port=1023
________________________________
 27   0.000312       vinayb -> qepc-miles   ETHER Type=0800 (IP), size =
54 bytes
 27   0.000312       vinayb -> qepc-miles   IP  D=192.82.162.65
S=150.166.75.35 LEN=40, ID=6926
 27   0.000312       vinayb -> qepc-miles   TCP D=1022 S=1023
Ack=40059 Seq=1227593921 Len=0 Win=61319
________________________________
 28   8.296753   qepc-miles -> vinayb       ETHER Type=0800 (IP), size =
60 bytes
 28   8.296753   qepc-miles -> vinayb       IP  D=150.166.75.35
S=192.82.162.65 LEN=44, ID=34060
 28   8.296753   qepc-miles -> vinayb       TCP D=514 S=1023 Syn Seq=40059
Len=0 Win=8192
 28   8.296753   qepc-miles -> vinayb       RSHELL C port=1023
________________________________
 29   0.000329       vinayb -> qepc-miles   ETHER Type=0800 (IP), size =
54 bytes
 29   0.000329       vinayb -> qepc-miles   IP  D=192.82.162.65
S=150.166.75.35 LEN=40, ID=6988
 29   0.000329       vinayb -> qepc-miles   TCP D=1023 S=514     Ack=40087
Seq=1227531947 Len=0 Win=61320
 29   0.000329       vinayb -> qepc-miles   RSHELL R port=1023
________________________________
 30   0.002796   qepc-miles -> vinayb       ETHER Type=0800 (IP), size =
60 bytes
 30   0.002796   qepc-miles -> vinayb       IP  D=150.166.75.35
S=192.82.162.65 LEN=40, ID=34316
 30   0.002796   qepc-miles -> vinayb       TCP D=514 S=1023 Rst Seq=40087
Len=0 Win=0
 30   0.002796   qepc-miles -> vinayb       RSHELL C port=1023
________________________________
 31   2.919513   qepc-miles -> vinayb       ETHER Type=0800 (IP), size =
60 bytes
 31   2.919513   qepc-miles -> vinayb       IP  D=150.166.75.35
S=192.82.162.65 LEN=44, ID=35084
 31   2.919513   qepc-miles -> vinayb       TCP D=514 S=1023 Syn Seq=40059
Len=0 Win=8192
 31   2.919513   qepc-miles -> vinayb       RSHELL C port=1023
________________________________
 32   0.000290       vinayb -> qepc-miles   ETHER Type=0800 (IP), size =
54 bytes
 32   0.000290       vinayb -> qepc-miles   IP  D=192.82.162.65
S=150.166.75.35 LEN=40, ID=7002
 32   0.000290       vinayb -> qepc-miles   TCP D=1023 S=514     Ack=40087
Seq=1227531947 Len=0 Win=61320
 32   0.000290       vinayb -> qepc-miles   RSHELL R port=1023

Packets prior to 28 are part of the earlier connection. Packets from 28
onwards belong to the new session (executing the same command again). The
packets of interest are 28 and 29. 

The NT box initiates a new TCP connection as shown in packet 28. However,
it chooses to use a ISN which is lower than the previous SEQ number for
the same earlier connection and the 2MSL timeout has not yet expired. The
Irix box responds by sending a ACK packet of the previous connection is
shown in packet 29.  The NT responds with a RST in packet 30. This where
the great debate starts. Since the 2MSL has not expired and according to
RFC 1337 (Time Wait Assassination Hazard), we do nothing but send a ACK
from the previous session.  Isn't this the correct behavior? Because I
have noticed that some vendors drop the PCB from the TIME_WAIT state and
respond with a SYN-ACK for the retransmitted SYN from the PC. I have snoop
traces for SunOS and others which do that. I guess I am looking for what is
the correct approach for these kinds of situation. On the other hand, if
the NT SP4 were to generate the proper ISN than all this would not be
required.

Comments are appreciated.
Vinay
-- 
Vinay Bannai <[email-masked]>,  Email Pager: [email-masked] 
Networking Core, Ph: (650)-933-2510, Pager: 1-888-515-3512