Re: ipf rules preventing smtp traffic with ATT mailservers

[Paul Theodoropoulos <ipfilter@anastrophe.com>]

At 01:55 PM 6/1/2007, Carson Gaspar wrote:
> And the associated ipf logs?
> Right now, it looks like one of the ACKs from the SMTP server is being
> blocked (but your snoop has no timestamps, so it's hard to be sure).

unless i'm mistaken, each packet is indeed timestamped - 

ETHER:  Packet 1 arrived at 12:38:34.48752

etc.
> Window scaling is being
> negotiated for this connection. Try disabling window scaling on your
> server and see if that fixes things. If so, you're either running an
> older ipf code base, or Darren still has window scaling bugs to
> fix.

Disabling wscale did indeed fix it! from my first message in the thread,
i'm running the version included with solaris 10 - 


root-klaatu /etc/ipf% ipf -V
ipf: IP Filter: v4.1.9 (592)
Kernel: IP Filter: v4.1.9
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 1
Feature mask: 0x107

i'll see if installing the current version resolves this without
disabling wscale.

thanks very much for your analysis!

Paul Theodoropoulos
http://www.anastrophe.com