Subject: Re: [Tsvwg] port randomization

From: Joe Touch <[email-masked]>
Date: Fri, 13 Apr 2007 22:35:27 -0700

Fernando Gont wrote:
...
> The collisions we are more concerned about are those that happen when
> the client chooses a port number for which there's a TCP in the
> TIME_WAIT state at the server (rather than "local collisions" because of
> a port number being currently in use at the client side).
> 
> The problem here is that in BSD-derived systems, if there's a collision
> the connection attempt might timeout after 75 seconds or so (IIRC, SYN
> segments received for connections in the TIME-WAIT state with an ISN
> smaller that the last sequence number seen on the connection are
> ignored). OTOH, if the server strictly implements RFC 793, the
> connection attempt would lead to the assassination of the TIME-WAIT
> state (unless there's some spec that I missed).

Receiving a SYN in TW has two possible results:
	- if not in window, resend the last valid ACK
	- if in window, kill the TW and send a RST
		this assassinates your TW, but also ought
		to cause the other side to go into TW
		(unless the RST is lost)

		FWIW, this is another example of why RST-senders
		ought to go into TW (as Ted and I noted in our
		Infocom99 pub)

Joe

-- 
----------------------------------------
Joe Touch
Sr. Network Engineer, USAF TSAT Space Segment

---

From: "Anantha Ramaiah \(ananth\)" <[email-masked]>
Date: Mon, 16 Apr 2007 11:02:48 -0700

> > TIME_WAIT state at the server (rather than "local 
> collisions" because 
> > of a port number being currently in use at the client side).
> > 
> > The problem here is that in BSD-derived systems, if there's a 
> > collision the connection attempt might timeout after 75 
> seconds or so 
> > (IIRC, SYN segments received for connections in the TIME-WAIT state 
> > with an ISN smaller that the last sequence number seen on the 
> > connection are ignored). OTOH, if the server strictly 
> implements RFC 
> > 793, the connection attempt would lead to the assassination of the 
> > TIME-WAIT state (unless there's some spec that I missed).
> 

> 	- if not in window, resend the last valid ACK

Which would cause the other side to Reset , since :

 If the state is SYN-SENT then

      first check the ACK bit

        If the ACK bit is set

          If SEG.ACK =< ISS, or SEG.ACK > SND.NXT, send a reset (unless
          the RST bit is set, if so drop the segment and return)

            <SEQ=SEG.ACK><CTL=RST>

          and discard the segment.  Return.

> 		to cause the other side to go into TW

Hmm.. The other side is in SYNSENT state, so receiving an RST would tear
down the connection. So the other side wouldn't go to TIMEWAIT unless
you are proposing to change the TCP state diagram, adding an arc from
SYNSENT to TIMEWAIT :-)

If we follow RFC 793 strictly, it would lead to Timewait assasination in
both the cases, unless a stack implements what BSD does as Fernando
pointed out, situation is slightly different. 

> 		ought to go into TW (as Ted and I noted in our

Ok, if the particular stack in question implements the suggestions
outlined above, may be things are different, but as it stands today (per
RFC) it causes TIMEWAIT assasination.

-Anantha