On Thu, Aug 11, 2022 at 10:23:47PM +0100, Graeme Coates via Exim-users wrote:
> > At this point it would be useful to see the full PCAP file for just the
> > traffic involving client port "44884".
> >
> > $ tcpdump -s0 -r /some/file.pcap -w /tmp/tfo.pcap tcp port 44884
> >
> > The tshark summary decode elides some details...
>
> No problem - here's a link to the pcap file filtered down by port 44884.
>
> https://www.chromosphere.co.uk/wp-content/blogs.dir/1/files/2022/08/tfo.zip
It still very much looks like client-side misbehaviour. One
complication is that you also have client-side TCP offload, but since
after STARTTLS the server only sends small ACK packets, its checksums
verify correctly, and essentially only the client packets carry
"incorrect" (to be computed in the NIC) checksums.
It may be worth trying to disable TCP offload in the NIC, and see
whether then TFO remains problematic. In other words, does it
somehow confuse the kernel or the NIC?
Still very odd that the problem would show up so late (~69k) into the
stream.
--
Viktor.
