Networker

[Networker] TCP: Treason uncloaked! message on client

2004-05-11 07:33:00
Subject: [Networker] TCP: Treason uncloaked! message on client
From: Les Yaw <yawles AT LUTHER DOT EDU>
To: NETWORKER AT LISTMAIL.TEMPLE DOT EDU
Date: Tue, 11 May 2004 06:30:35 -0500
Legato Server: SuSE 8.3    - Networker 7.1.1
Legato Client:  RedHat 7.2 -  Networker client 7.1 build 230

Ok, here's a good one.  We have a student storage server which is a client
of my Legato Networker server.  This student storage server has several
hundred gigs of RAID hard drive space.  Last night, our network monitoring
system alarmed to a high number of processes running.  My colleague in
charge of that server ran dmesg, and found several hundred of the following
listed (xxx is the IP address of my Legato server)

TCP: Treason uncloaked! Peer xxx.xxx.xxx.xxx:9766/12331 shrinks window
3720002881:3720004329. Repaired.

Googling shows a lot of theory - not much for fact.

Some believe the issue results from packet shaping
Some believe the issue results from timer.c keeping connections open
Some believe the issue indicates a DoS attack
Some believe the issue results during a remote client backup occurs (Hmm...
I'll go for this one!)

Has anyone else found this on their client machines?  I'm going to start
looking at my 25+ linux clients for other reports of the same.

I appreciate any help.

Les Yaw
Luther College
Decorah, IA

--
Note: To sign off this list, send a "signoff networker" command via email
to listserv AT listmail.temple DOT edu or visit the list's Web site at
http://listmail.temple.edu/archives/networker.html where you can
also view and post messages to the list.
=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=

<Prev in Thread] Current Thread [Next in Thread>
  • [Networker] TCP: Treason uncloaked! message on client, Les Yaw <=