2014-01-15 11:57:39

by Stuart Kendrick

[permalink] [raw]
Subject: unable to send TCP SYNs from ports lower than 1024

Is anyone else seeing this? This issue prevents NFS client mounting,
since the NFS client wants to use source ports below 1024

Linux ubuntu 3.8.0-35-generic #50~precise1-Ubuntu SMP Wed Dec 4
17:25:51 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

As I analyze, I use netcat plus wireshark to validate, with wireshark
running on both the client machine and on a second machine plugged
into the local Ethernet switch's SPAN port

This invocation produces outbound TCP SYNs in both traces:
ubuntu# nc -4 -p 1024 10.1.1.1 2049

Whereas this invocation produces TCP SYNs only in the on-board pcap --
the pcap taken from the switch's SPAN port contains nothing (well, it
contains the ARP exchange with10.1.1.1, but no TCP frames).
ubuntu# nc -4 -p 1023 10.1.1.1 2049

I have some evidence to suggest that it appeared in 3.8.0-33 or higher

--sk

Stuart Kendrick


2014-01-16 13:37:03

by Stuart Kendrick

[permalink] [raw]
Subject: Re: unable to send TCP SYNs from ports lower than 1024

I didn't think of the switch angle ... inserting an in-line tap on
either side of the switch ... shows that it is dropping these frames.
Thanx for the suggestion

--sk

On Wed, Jan 15, 2014 at 5:37 AM, Jim Rees <[email protected]> wrote:
> Stuart Kendrick wrote:
>
> Is anyone else seeing this? This issue prevents NFS client mounting,
> since the NFS client wants to use source ports below 1024
>
> It seems pretty unlikely this is actually broken without anyone noticing.
> Did you check your iptables and switch acls?

2014-01-15 13:37:27

by Jim Rees

[permalink] [raw]
Subject: Re: unable to send TCP SYNs from ports lower than 1024

Stuart Kendrick wrote:

Is anyone else seeing this? This issue prevents NFS client mounting,
since the NFS client wants to use source ports below 1024

It seems pretty unlikely this is actually broken without anyone noticing.
Did you check your iptables and switch acls?