Spurious tcp reset packets?

[Bruno Wolff III]

I have been seeing spurious tcp resets for ssh connections for the last
several weeks. I haven't tracked down the source yet. I was wondering
if any one else was seeing any? I think my LAN router is a suspect for
them but if other people were seeing them I might suspect that there is
something on their network and I would make getting the EFF's tool a try
a higher priority.

[qay...@gmail.com]

I haven't been having any problems SSHing to or from my server on a
Speakeasy DSL line.

[Scott Hemphill]

I am no longer a Speakeasy customer, but post this in the slight
chance it may be of some use:

Are the resets truly spurious, or do they look like timeouts? If they
are timeouts, then you can work around them with a suitable
ClientAliveInterval in /etc/ssh/sshd_config on the server end.

Good luck!

Scott
--
Scott Hemphill hemp...@alumni.caltech.edu
"This isn't flying. This is falling, with style." -- Buzz Lightyear

[Bruno Wolff III]

On 2008-08-25, Scott Hemphill <hemp...@hemphills.net> wrote:
> Bruno Wolff III <br...@wolff.to> writes:
>
> Are the resets truly spurious, or do they look like timeouts? If they
> are timeouts, then you can work around them with a suitable
> ClientAliveInterval in /etc/ssh/sshd_config on the server end.

No they aren't timeouts. Blocking them seems to help. I think the most
likely cause is an overloaded firewall either on the router or the server.
I think the connection tracking might be getting overloaded by all of the
spam connections. The server is falling back to using syn cookies and the
problems with connections seem to correlate with when this is happening.
I have some ideas on how to test if the firewall on the server is having
a problem and I think I will start there as that is the most likely cause.