[SOLVED] tcp checksum error

[bendeguz]

***Solution is down this page...***


***********WORKAROUND************
I got help on http://hup.hu/node/84548 and there is a link in the thread to http://www.linuxquestions.org/questions ... d.-620209/
where the guy has the same problem that i have.

He has the following workaround:
when the problem occurs, then turn off tcp timestamp

Code: Select all

# echo > 0 /proc/sys/net/ipv4/tcp_timestamps

or you can do this at boot time with sysctl

Well, i'm going to try kernel downgrade, memtest and reloading the kernel driver when the problem happens to find real solution.
************************************
Hi!

I have a quite strange problem, that i couldn't solve so far. Maybe you guys can give me some hint.

So, i have a working internet connection. Everything is working fine, until a few hours uptime (~10 hours).
Then there are some web pages like google.com, which i can't download.
Here is a snippet of tcpdump's output:

Code: Select all

23:32:43.585704 IP (tos 0x0, ttl 64, id 14707, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.xxx.33651 > 74.125.87.103.http: Flags [S], cksum 0xb933 (correct), seq 2101470733, win 5840, options [mss 1460,sackOK,TS val 35318584 ecr 0,nop,wscale 5], length 0
23:32:43.589300 IP (tos 0x0, ttl 52, id 22479, offset 0, flags [none], proto TCP (6), length 60)
    74.125.87.103.http > xxx.xxx.xxx.xxx.33651: Flags [S.], cksum 0x3ebc (incorrect -> 0x3ebd), seq 2695772244, ack 2101470734, win 5672, options [mss 1430,sackOK,TS val 2382952887 ecr 35259808,nop,wscale 6], length 0

Code: Select all

~ $ sudo ethtool --show-offload eth0
Offload parameters for eth0:
Cannot get device rx csum settings: Operation not supported
rx-checksumming: off
tx-checksumming: off
scatter-gather: off
tcp segmentation offload: off
udp fragmentation offload: off
generic segmentation offload: off

After reboot everything is working fine again. A have changed the network card but the problem still remains.
I just realized that, now i can download google.com, but there are other pages which has the same problem.
I hope it's a hw problem, and not some malicious code in my system.

Thanks for reading...

UPDATE: i was updating the system at night, it was offline, but in the morning i still couldn't connect to google.com. Now i'm still updating but if that won't help, am going to boot my old system for the night to find out if it is hw problem. Then if it is not hw problem, i thing im going to have to rebuild the system, and reconfigure everything.

I'm a bit afraid of someone got into my system, but there are every ports closed. I was just torrenting
a few hours one month ago.

********UPDATE*********
So, i was booted my old gentoo on another hd, which i haven't used for 5 months now, left it running for the night, and at the morning i couldn't reach the web pages i have problems with.

Summary:
- I have these network problems on my gentoo installs
- I don't have these problems on OpenBSD and on gentoo boot cd
- I have the problems with different NICs

So, I think this is a hardware problem, which comes out with the optimized compilations. (Is it
possible?)
Unfortunately I couldn't test it on another hardware and it's really hard to test if i have to wait
10 hours 'till the problem comes.
**************************

[bendeguz]

So, i was booted up from gentoo cd, but i didn't have problems with it. => my problem is not hardware related
I'm in the ~x86 branch, but this is a very strange problem.

I tried this, too: I was using the system all day, a i didn't use the network. I tcpdumped the data flow to see if there is outgoing data, but a couldn't see anything suspicous. At the start i went to google.com, and i saw checksum correct messages. After 10 hours i went again to google.com and a saw checksum error messages, and couldn't load the page. I have this problem with a few more pages i have checked, but im sure there would be more. Btw. I can load a lot of other pages, like gentoo.org.

If i cant find a solution, i'll have to reinstall everything I'm afraid of this is some hacking, but it would be a very strange hack.

Any suggestions? I'm stuck, and really need some advice.

[bendeguz]

I've made a clean install, mounted my old /home and /boot (UPDATE: and swap) and got the same problem.

Maybe i''ll borrow another PC and put my getoo in it, but now i have enough.

Thanks for reading!

[bendeguz]

I've made a clean install, mounted my old /home and /boot (UPDATE: and swap) and got the same problem.

Maybe i''ll borrow another PC and put my getoo in it, but now i have enough.

I also tried my old OpenBSD install and there were no problems.
So maybe there is some crap on my swap, so i made a new swap for try.

If I was hacked, what should i do? I really would like to use my old gentoo that i have been using fo 1,5 years now.
Is it enough to recompile everything and clean temporary directories and swap? Or is it safer to use my new install? (Btw: i was made that new install chrooted from my current gentoo. Maybe that could cause that the new install had an error too. If this is the case, then i have to install a system from boot cd.)

[bendeguz]

****************************SOLUTION***************************

I realized my problems were started, when i changed my router. Before i had a pc for routing, with floppyfw.
Unfortunately, that pc is really old and don't want to boot. So i borrowed another pc and fired up floppyfw.
When the problem came with the new router(TP-LINK TL-R860) i plugged the net and my pc to floppyfw and i could reach any page. And a didn't reboot my desktop, and didn't make changes to it. Then a plugged back to TP-LINK and couldn't browse certain pages again. And a didn't reboot my desktop.

So the problem comes when i use linux and tp-link router. So i guess there is some problem with the kernel.

The gentoo boot cd has .25 kernel or something like that and i guess it has everything compiled in, and i don't have a problem there. Maybe i'll have to try different kernel configs in the future.

Any replies would be much appreciated!

[Jaglover]

When the problem came with the new router(TP-LINK TL-R860) i plugged the net and my pc to floppyfw and i could reach any page. And a didn't reboot my desktop, and didn't make changes to it. Then a plugged back to TP-LINK and couldn't browse certain pages again. And a didn't reboot my desktop.

So the problem comes when i use linux and tp-link router. So i guess there is some problem with the kernel.

Why you rule out this router. I had Yahoo DSL once upon time, its firmware violated RFC 1035 and my DHCP client choked.

[bendeguz]

Why you rule out this router.

Sorry, i don't understand this. You mean why am i not using "this router"? Which one?
I'm glad, someone has posted a reply:)