pvaneynd

For some reason if I use window scaling the pop3 servers from belgacom and skynet just don't react anymore. I did tcpdumps and I noticed two things: 1 the window size on my size (5882 bytes) is slighty larger then the first message and 2 it is the belgacom server that tells me the data is coming and then sends nothing anymore.

One really wonders how you have to misconfigure a firewall to get this effect.

For reference, this is the final part of the br0ken session:

21:03:15.582286 IP (tos 0x0, ttl  59, id 26304, offset 0, flags [DF], length: 64) pop3pool1.skynet.be.pop3 > 192.168.2.146.35934: P [tcp sum ok] 102:114(12) ack 45 win 33648 <nop,nop,timestamp 272247069 23548276>
21:03:15.582406 IP (tos 0x0, ttl  64, id 6659, offset 0, flags [DF], length: 60) 192.168.2.146.35934 > pop3pool1.skynet.be.pop3: P [tcp sum ok] 45:53(8) ack 114 win 46 <nop,nop,timestamp 23548296 272247069>
21:03:15.603703 IP (tos 0x0, ttl  59, id 26305, offset 0, flags [DF], length: 69) pop3pool1.skynet.be.pop3 > 192.168.2.146.35934: P [tcp sum ok] 114:131(17) ack 53 win 33648 <nop,nop,timestamp 272247071 23548296>
21:03:15.643052 IP (tos 0x0, ttl  64, id 6660, offset 0, flags [DF], length: 52) 192.168.2.146.35934 > pop3pool1.skynet.be.pop3: . [tcp sum ok] 53:53(0) ack 131 win 46 <nop,nop,timestamp 23548357 272247071>
21:08:15.602549 IP (tos 0x0, ttl  64, id 6661, offset 0, flags [DF], length: 52) 192.168.2.146.35934 > pop3pool1.skynet.be.pop3: F [tcp sum ok] 53:53(0) ack 131 win 46 <nop,nop,timestamp 23848363 272247071>

While the working session just hums along:

21:12:44.136516 IP (tos 0x0, ttl  59, id 18718, offset 0, flags [DF], length: 64) pop3pool1.skynet.be.pop3 > 192.168.2.146.35939: P [tcp sum ok] 102:114(12) ack 45 win 33648 <nop,nop,timestamp 377765297 24112172>
21:12:44.136672 IP (tos 0x0, ttl  64, id 9535, offset 0, flags [DF], length: 60) 192.168.2.146.35939 > pop3pool1.skynet.be.pop3: P [tcp sum ok] 45:53(8) ack 114 win 5840 <nop,nop,timestamp 24116938 377765297>
21:12:44.151989 IP (tos 0x0, ttl  59, id 18719, offset 0, flags [DF], length: 69) pop3pool1.skynet.be.pop3 > 192.168.2.146.35939: P [tcp sum ok] 114:131(17) ack 53 win 33648 <nop,nop,timestamp 377765298 24116938>
21:12:44.159030 IP (tos 0x0, ttl  59, id 18720, offset 0, flags [DF], length: 1076) pop3pool1.skynet.be.pop3 > 192.168.2.146.35939: . [tcp sum ok] 131:1155(1024) ack 53 win 33648 <nop,nop,timestamp 377765299 24116938>
21:12:44.159070 IP (tos 0x0, ttl  64, id 9536, offset 0, flags [DF], length: 52) 192.168.2.146.35939 > pop3pool1.skynet.be.pop3: . [tcp sum ok] 53:53(0) ack 1155 win 7168 <nop,nop,timestamp 24116961 377765298>
21:12:44.160882 IP (tos 0x0, ttl  59, id 18721, offset 0, flags [DF], length: 488) pop3pool1.skynet.be.pop3 > 192.168.2.146.35939: P [tcp sum ok] 1155:1591(436) ack 53 win 33648 <nop,nop,timestamp 377765299 24116938>
21:12:44.178325 IP (tos 0x0, ttl  59, id 18722, offset 0, flags [DF], length: 1076) pop3pool1.skynet.be.pop3 > 192.168.2.146.35939: . [tcp sum ok] 1591:2615(1024) ack 53 win 33648 <nop,nop,timestamp 377765301 24116961>

I'm anoyed the "helpdesk" claimed it is not their problem :-(.