On Mon, 13 Nov 2006, Camiel Dobbelaar wrote:
> Ok, I think I found something in your original tcpdump:
>
> Nov 11 15:15:04.389556 failinghost.domain.com.ftp >
> ftp-proxy.domain.com.48293: P 202:233(31) ack 56 win 46
^^^^^^
> <nop,nop,timestamp 172680957 3630957581> (DF) [tos 0x10]
> 0000: 4510 0053 7066 4000 4006 0292 c2f5 20b4 [EMAIL PROTECTED]@...C5 B4
> 0010: c2f5 20fe 0015 bca5 48d1 b99c bc2d 18c1 C5 C>..B<B%HCB9.B<-.C
> 0020: 8018 002e b0fa 0000 0101 080a 0a4a e6fd ....B0C:.......JC&C=
> 0030: d86c 040d 3235 3720 222f 2220 6973 2063 C l..257 "/" is c
> 0040: 7572 7265 6e74 2064 6972 6563 746f 7279 urrent directory
> 0050: 2e0d
Whoops, and then pine dumped core on me.
What I wanted to say: notice how failinghost shrinks the TCP window to
just 46 bytes ("win 46"). That's not enough to fit the long path of the
directory change, so that stays in the network buffers of the firewall
waiting for failinghost to send an ACK with a bigger window size
("opening up the window").
Looks like failinghost is responsible for the stalled TCP connection.
--
Cam
