Path: utzoo!attcan!uunet!lll-winken!ames!pasteur!helios.ee.lbl.gov!nosc!ucsd!ucbvax!DUPHY4.Drexel.Edu!lane
From: lane@DUPHY4.Drexel.Edu (Charles Lane)
Newsgroups: comp.protocols.tcp-ip
Subject: SYNs that don't get ACKed
Message-ID: <890116135041.10ad@DUPHY4.Drexel.Edu>
Date: 16 Jan 89 18:50:41 GMT
Sender: daemon@ucbvax.BERKELEY.EDU
Organization: The Internet
Lines: 28

I've noticed that our mailer is getting a number of SYN
packets directed at it (~2/hr...from west coast hosts)
that it can never seem to ACK and get a connection going.

The sequence of events is like this (Us = 129.25.1.103, port 25, SMTP;
Them = CRVAX.SRI.COM)

Them:  SYN              SMTP server process starts, and:
                        Us: ACK SYN
....        about 1 min later   ...
Them:  SYN  (duplicate)
                        Us: ACK SYN

this repeats (retransmitted SYNs in, retransmitted ACK SYNs out)
until finally one (or both) get fed up and time out.

The best explanation that I can come up with is that the ACK SYN's
aren't getting back to CRVAX.  Could this be a routing problem?
We've observed this behaviour with a number of hosts, and the best
explanation we've thought of so far is that the packets are coming in
over a `good' route and going out over a `bad' route.

I'd appreciate any comments or suggestions.

                                --Charles Lane
                                lane@duphy4.drexel.edu
                                cel@cithex.caltech.edu
                                lane@duphy1.bitnet