Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!rt.uk.eu.org!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: Stefan Monnier Newsgroups: comp.os.linux.networking Subject: TCP connections freezing unexplicably Date: Sun, 11 May 2014 22:52:51 -0400 Organization: A noiseless patient Spider Lines: 75 Message-ID: Mime-Version: 1.0 Content-Type: text/plain Injection-Info: mx05.eternal-september.org; posting-host="d46307bf73a472342d1b25e2ead5568f"; logging-data="27809"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/rmd4Ff8G5x1KzQgCWErXC" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.4.50 (gnu/linux) Cancel-Lock: sha1:sHsuzlphzwdF0xQfsO+R+j4fJ/c= sha1:hfRdadbQNbfar6VK944n6lOrTGM= Xref: csiph.com comp.os.linux.networking:2945 I have a problem where TCP connections to a machine of mine tend to freeze in a way I can't explain. Here are the symptoms: - I ssh into the machine, and right in the middle of some output the connection just freezes. If I have other simultaneous SSH connections multiplexed over the same underlying TCP connection, they freeze as well. - I connect via imap-over-ssl to that same machine, and similarly the connection randomly hangs. - As mentioned, those hangs seem to happen when there is activity, rather than when the connection is idle. - One TCP connection freezing does not prevent other TCP connections from working just fine. E.g. if I have two SSH connections (not multiplexed over the same TCP connection), one might freeze while the other keeps working fine. - This happens when connecting from various different places (e.g. from home behind a NAT router, from a server with no NAT in sight, ...). - I can somewhat reproduce the freeze at will, by connecting over ssh and then doing "du /home" (which generates a fair bit of output). Maybe I'll have to do "du /home" a second or a third time, but I've never needed more to reproduce the problem. - There's nothing magical about "du", the freeze also happens in many other cases. - "dmesg" is desperately silent. Some more info about the context: This machine is connected to the Internet via its eth0 with a fixed routable IPv4 address. It is running Debian stable over Linux-3.4 (well, the linux-sunxi variant of it, but that shouldn't make much difference here, hopefully). Other than its eth0 interface it has two more network interfaces: - an ethernet USB dongle (name "eth-usb"). - a tun0 handled by OpenVPN. Each of those uses a local non-routable (192.168.x.x) network, so it uses NAT to provide Internet access to those machines connected over one of those two interfaces. The iptables setup is very simple, see below. The SSH and IMAP-over-SSL connections I talk about above all come from the Internet (i.e. over the eth0 interface). Any idea where the problem might be coming from? How could I try to track it down? Stefan # iptables -t nat -vL Chain PREROUTING (policy ACCEPT 605K packets, 65M bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 595K packets, 65M bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 2104 packets, 147K bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 11 packets, 874 bytes) pkts bytes target prot opt in out source destination 2296 161K MASQUERADE all -- any eth0 anywhere anywhere # iptables -vL Chain INPUT (policy ACCEPT 1109K packets, 189M bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 1925 packets, 417K bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 97455 packets, 29M bytes) pkts bytes target prot opt in out source destination #