请教网络高手一个超级难题： -holdon(again) @佛州华人论坛:佛州枫下论坛 The Rolia Forum of Florida

请教网络高手一个超级难题：

holdon(again)

本文发表在 rolia.net 枫下论坛我使用的是自己公司提供的DSL上网服务。上周公司网络升级，结果发现我上不了网了。但是其它大部分公司的DSL用户没问题。我也不是完全不能上网，症状很奇怪：
可以ssh到公司的任何一台Linux机器，执行ls没问题，执行ls -l ssh client立刻hanp up ,没有列出任何文件。开始怀疑是数据包一大才出错。在一台web server上建了一个小文本文件，从我的机器通过http请求可以正常访问该文件。不断增大该文件，发现到1203个字节时该文件无法访问（1201时很快，没有任何问题。)

另一个试验证明上传没有问题：通过一个sftp client 成功连接到一个server, 上传一个72K的文件没有任何问题，试图下载该文件sftp client立刻挂起，一个字节也没下下来。

检查了我的 DSL Router, 有3个参数：
MRU 1492 ; MTU 1492; MSS 1432
在不改变任何参数的情况下，使用一个Sympatico 的DSL 账号，拿到一个sympatico的地址，访问网络没有任何问题。

找到一篇关于MRU, MTU, MSS 的解释：
http://www.draytek.co.uk/support/kb_vigor_mtu.html

修改参数为
MRU 960 ; MTU 960; MSS 900

重起router后奇迹发生，可以正常访问网络了！反复调整参数测试，发现是MSS在起作用，必须小于大约1400才行。
现在参数是
MRU 1492; MTU 1492; MSS 1332,能正常上网。

哪位高手能给分析一下为什么MSS 1432就无法正常上网？有什么可能原因呢？不是MSS 小于MTU 40 就可以了吗？

多谢回复。更多精彩文章及讨论，请光临枫下论坛 rolia.net

(#2646245@0)
Last Updated: 2005-12-6
This post has been archived. It cannot be replied.

另外一些测试结果： -holdon(again); 2005-12-6 {364} (#2646286@0)

不管MRU,MTU MSS为何值，router里的route table总是正确的。gateway 正确指向公司的一台Cisco 3640 设备

发现
ping 3640.ip -l 1432 成功
ping 3640.ip -l 1433 time out.

但是ping其它任何公司的机器都是
ping ip -l 1430 成功
ping ip -l 1431 time out

ping www.yahoo.com 也是1430成功，1431失败。

但是使用Sympatico时，好像
ping www.yahoo.com -l 2000 都可以成功。

顶 -holdon(again); 2005-12-6 (#2646481@0)

. -canadiantire(轮胎-M.I.N.K.); 2005-12-6 (#2646520@0)

找到一篇很好的文章： http://info.connect.com.au/docs/permconnections/adsl-customer-info.pdf 在它的提示下，发现MSS最大值是1418. 设成1419就不工作了。 -holdon(again); 2005-12-6 (#2646531@0)

下面的一段话是要点： -holdon(again); 2005-12-6 {1820} (#2646538@0)

本文发表在 rolia.net 枫下论坛There are many causes and various fixes or workarounds. Most relate to end users or the transit network running PPP with
other protocols thus causing the protocol overhead and payload to exceed the common MTU of 1500 bytes. PPPoE
typically requires an MTU of 1492 bytes. PPPoA typically requires an MTU of 1500 bytes. When either of these
protocols are used in conjunction with L2TP as a transfer protocol, problems can occur because the L2TP protocol adds an
extra protocol overhead thus pushing the total packet size of a PPPoA connection from 1500 to 1540 bytes, and PPPoE
from 1492 to 1532.

Since most network links inside provider networks run Ethernet(with a MTU of 1500 bytes), the provider must chop the
data into smaller pieces to fit through(fragmentation). This is generally not an issue unless other protocol safeguards
additionally fail. The first is ICMP type 3, code 4 or more commonly known as message ‘Fragmentation needed and Don’t
Fragment(DF) bit set’ which is sent back to the originator of the large packet to request a smaller packet that can fit
through. This is called Path MTU Discovery (PMTUD). If this important message is blocked at any stage in the end to end
data session, the packet size discovery phase is broken and all large packets are simply dropped, this is the where the end
user sees their download freeze. This is a common problem on Internet links and through providers who install blanket
ICMP filters to stop Denial of Service(DoS) attacks called Ping Floods therefore blocking all messaging traffic, good and
bad. A more intelligent way to implement this is by only blocking/limiting the bad traffic and allowing the important
messages through. This generally requires a good understanding of how the protocol works and how to apply the filters
properly.更多精彩文章及讨论，请光临枫下论坛 rolia.net

高手帮忙看看阿：用tcpdump 在web server 纪录了一下 MSS=1432 时dsl client 的一个http request: -holdon(again); 2005-12-6 {1887} (#2647203@0)

本文发表在 rolia.net 枫下论坛14:06:08.482789 dsl.client.ip.2811 > server.ip.address.http: . ack 204 win 16981 <nop,nop,sack sack 1 {1636:1810} > (DF)
14:06:08.484842 dsl.client.ip.2812 > server.ip.address.http: . ack 520 win 16665 <nop,nop,sack sack 1 {1952:2600} > (DF)
14:06:08.750555 server.ip.address.http > dsl.client.ip.2812: . 520:1952(1432) ack 865 win 7504 (DF)
14:06:08.820545 server.ip.address.http > dsl.client.ip.2811: . 204:1636(1432) ack 971 win 7504 (DF)
14:06:08.860550 server.ip.address.http > dsl.client.ip.2807: . 520:1952(1432) ack 866 win 7504 (DF)
14:06:09.530555 server.ip.address.http > dsl.client.ip.2812: . 520:1952(1432) ack 865 win 7504 (DF)
14:06:09.780555 server.ip.address.http > dsl.client.ip.2811: . 204:1636(1432) ack 971 win 7504 (DF)
14:06:10.200561 server.ip.address.http > dsl.client.ip.corbaloc: . 520:1952(1432) ack 864 win 7504 (DF)
14:06:10.730558 server.ip.address.http > dsl.client.ip.2805: . 0:1432(1432) ack 2 win 7504 (DF)
14:06:11.090554 server.ip.address.http > dsl.client.ip.2812: . 520:1952(1432) ack 865 win 7504 (DF)
14:06:11.700556 server.ip.address.http > dsl.client.ip.2811: . 204:1636(1432) ack 971 win 7504 (DF)
14:06:12.160557 server.ip.address.http > dsl.client.ip.2810: . 1:1433(1432) ack 454 win 6432 (DF)
14:06:13.490561 server.ip.address.http > dsl.client.ip.2804: . 0:1432(1432) ack 2 win 7504 (DF)
14:06:14.210585 server.ip.address.http > dsl.client.ip.2812: . 520:1952(1432) ack 865 win 7504 (DF)
14:06:15.410560 server.ip.address.http > dsl.client.ip.2806: . 204:1636(1432) ack 972 win 7504 (DF)
14:06:15.411221 cd > server.ip.address: icmp: redirect dsl.client.ip to host dsl.client.ip [tos 0xc0]
14:06:15.540570 server.ip.address.http > dsl.client.ip.2811: . 204:1636(1432) ack 971 win 7504 (DF)

这个东西什么意思啊？
14:06:15.411221 cd > server.ip.address: icmp: redirect dsl.client.ip to host dsl.client.ip [tos 0xc0]更多精彩文章及讨论，请光临枫下论坛 rolia.net

哎。这么多高手，CISCO认证一堆，就没人发表一点意见。 -holdon(again); 2005-12-7 (#2648431@0)

Ha, you already got the answer. The MSS caculation is the MTU - size(TCP_IP_HEAD) - size(other_head) -bugfree(BugFree); 2005-12-7 {178} (#2648475@0)
Try to capture some tcp packet on your network, you will find there 40 bytes for TCP + IP head. You must using some wired tcp head in your tcp/ip header occupied other 120 bytes.

多谢多谢。到没有120字节那么多。最后确定MSS最大工作值是1418.我是早就可以上网了，但是还有少量客户上不了阿。 -holdon(again); 2005-12-7 {725} (#2648673@0)
想想这两天我一直在用中式英语向初中毕业的白大妈解释：you need to change the MTU in your computer ... "MTU? screw you!"

事实上MTU即使不对正常情况应该也可以工作，因为两边可以通过PMTUD来协调包大小。带宽升级前也都工作正常。PMTUD需要ping type3还是4 ，现在的问题是哪个地方被断掉了。

不过我基本发现问题所在了，应该是Cisco3640. 昨天一直在测 home ping cisco, office ping cisco , home ping office 都没问题，但是漏了一个 office ping home.

home ip 是一个DSL Router, 以前都可以ping的，我还可以直接从office通过http 管理router. 今天测了office ping home, 居然不通。 arp -a 发现home 和cisco的mac 地址一样。login到cisco 3640, ping home, 居然也不通。下面就是cisco guy的事。不过我们公司找的这个家伙看来不怎么样，不知道他搞得定不。

let me have the access to your devices, 让我进去看看。 -coolj(酷不起来); 2005-12-7 (#2648756@0)

多谢。还得先找我们公司cisco guy看，如果不行，他就该被踢出去了，那时再找你吧，还可以给你挣点零花。 -holdon(again); 2005-12-7 (#2648880@0)

there are 2 things you may want to look at it. one is the icmp filter, the common problem is that people often blocks the icmp unreachable packets on the perimeter routers, -coolj(酷不起来); 2005-12-7 (#2648918@0)
it causes the router to drop the packet when the mtu size exceeds it's buffer. second, configure the router to clear the DF bit. -coolj(酷不起来); 2005-12-7 (#2648921@0)

Yes, this sounds like a good idea, it's also suggested in the pdf document. -holdon(again); 2005-12-7 (#2648926@0)

another thing is to have your client hack the system's registry, manually edit the mtu size but it would be pain in the neck. -coolj(酷不起来); 2005-12-7 (#2648934@0)

That's what I was doing yesterday. I tried to explain to one customer what's MTU and why we need to change it (she is beyond our average customer) and here was her response: don't talk chinese to me. -holdon(again); 2005-12-7 (#2648960@0)

kao, 还是她很！ -coolj(酷不起来); 2005-12-7 (#2649095@0)

U could go to CSDN.NET to post ur question, there are always some expert there glad to answer the questions -binghongcha76(一只大猫); 2005-12-7 (#2648893@0)

谢谢。我一般去experts-exchange,以前的问题一般都有答案。这次没人理我。有空去看看csdn. -holdon(again); 2005-12-7 (#2648912@0)

@Florida

请教网络高手一个超级难题：

Replies, comments and Discussions:

More Topics