At 01:55 PM 6/1/2007, Carson Gaspar wrote:
And the associated ipf logs? Right now, it looks like one of the
ACKs from the SMTP server is being blocked (but your snoop has no
timestamps, so it's hard to be sure).
unless i'm mistaken, each packet is indeed timestamped -
ETHER: Packet 1 arrived at 12:38:34.48752
etc.
Window scaling is being negotiated for this connection. Try
disabling window scaling on your server and see if that fixes
things. If so, you're either running an older ipf code base, or
Darren still has window scaling bugs to fix.
Disabling wscale did indeed fix it! from my first message in the
thread, i'm running the version included with solaris 10 -
root-klaatu /etc/ipf% ipf -V
ipf: IP Filter: v4.1.9 (592)
Kernel: IP Filter: v4.1.9
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 1
Feature mask: 0x107
i'll see if installing the current version resolves this without
disabling wscale.
thanks very much for your analysis!
Paul Theodoropoulos
http://www.anastrophe.com
