>The download then fails after about 90 sec.  

Are you setting any timeouts in your rc.firewall ruleset?  If not, 
try doing that first.  Its described in TrinityOS - Section 10.


>Why in the second dump does the far end send packets to my windows machine
>(192.168.1.101), shouldn't that be behind the ipmasq?

First, in your tcpdump, 

1. onlpatch.quicken.com.http - This must be Intuit's update server
2. supermega.little.net.3516 - What is this server?  
        Is this your 192.168.1.101 server?
3. pm1-17.ro.com.64583 - This must be your Linux box

What is #2???  The reason being:

--
23:27:48.751953 onlpatch.quicken.com.http > supermega.little.net.3516: .
141:1601(1460) ack 471 win 61320 (DF)
23:27:48.914063 pm1-17.ro.com.64583 > onlpatch.quicken.com.http: . ack 1601 win
8760 (DF)
--

Thats an odd traffic flow.  

--David
.----------------------------------------------------------------------------.
|  David A. Ranch - Linux/Networking/PC hardware         [EMAIL PROTECTED]  |
!----                                                                    ----!
`----- For more detailed info, see http://www.ecst.csuchico.edu/~dranch -----'


_______________________________________________
Masq maillist  -  [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]

Reply via email to