The SYN packet is reporting a broken TCP. Why does this being reported in the SYN and if there's any possible issue for the rest of the connections? asked 23 Sep '12, 07:59  ws2006 |
One Answer:
"Broken TCP" Expert Infos messages refer to a packet that does not comply with some aspect of the TCP specification, but that doesn't necessarily mean that there will be a problem with the communication. If would be helpful if you gave the entire error message. Are you seeing this one: "Acknowledgment number: Broken TCP. The acknowledge field is nonzero while the ACK flag is not set" ? In a TCP packet, when the ACK bit is not set, the Acknowledgment Number field is supposed to be set to zero. This error message means that the packet violates that rule: The ACK bit is not set, but the Acknowledgment Number field is not zero. The very first packet of a TCP three-way handshake will not have the ACK bit set because the system sending the SYN packet has not heard from the other system yet. It isn't acknowledging any data, and it doesn't know the other system's initial sequence number yet, so it can't calculate a valid ACK number. In this circumstance, the Acknowledgment Number field SHOULD be set to zero, but I've captured some traces where that isn't the case. Although it's non-compliant, this doesn't necessarily cause a problem when it's in the SYN packet. Because the ACK bit is not set, the receiving system will usually ignore the contents of the Acknowledgment Number field, so it won't be aware of the error. answered 23 Sep '12, 17:28  Jim Aragon Hmm. I don't see anything in RFC 793 or RFC 1122 about the acknowledgment number field having to be zero if the ACK flag isn't set, so this might be an indication of a TCP stack that forgot to set the ACK bit on a packet, but it's not an actual violation of the TCP specification. Perhaps the check we're doing should just check for non-initial-SYN packets without ACK. (23 Sep '12, 19:04) Guy Harris ♦♦ Now that I look, I can't find anything in the RFCs either. I did find an Internet draft titled "Normalization in the unused header fields of TCP/IP" that says "When the ACK bit is not set, the value of the acknowledgement field MUST be normalized. It must be set to some predefined value." However, it looks like this draft expired without ever becoming an RFC. (23 Sep '12, 19:44) Jim Aragon Without any intention to start a discussion about RFC interpretation: RFC793 states:
Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
|
You may be referring to the fact that ACK field is not set, and yet the ACK field is non-zero. Is that the error message you're getting?
Presumably "ACK flag is not set"?
Yes. "Acknowledgement Number: 0xa300898e [should be 0x00000000 because Ack flag is not set." The acknowledge field is non-zero while the ACK flag is not set.