Hi,List, I had just workarounded it by set "scrub in on $REQ_IF max-mss 1360 scrub out on $RESPOND_IF max-mss 1360" in pf.conf. Though the sites now can browsering, tcpdump showed a lot of "tcp retransmission" and "dup ack". I am puzzled of the different behavious from dfly to freebsd and linux. PAWS? aggregate_acks ?? Does exist some doc explains the difference about tcp implementiones or sysctl mibs about tcp?
Regards Simon δΊ 14-5-5 18:11, k simon ει: > > Hi,List, > Last day I migrate one haproxy box from FreeBSD to DflyBSD, then some > client reported can not browsering some site. After some investigation, > I found these client is benhind some NAT box or benhind firewall, the > other client without nat have no issue. > Then I modify the pf.conf with "scrub out on $RESPOND_IF max-mss > 1400", and I tried set the mssdflt or enable PMTU, but it has nothing > helped. With tcpudmped it shows > > 02:04:37.736802 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [S.], > seq 1060181879, ack 1461664647, win 32768, options [mss 1400], length 0 > 02:04:38.108258 IP 116.211.123.216.80 > 192.168.108.16.38589: Flags > [S.], seq 173104871, ack 3175683181, win 32768, options [mss 1400], length 0 > 02:04:38.145912 IP 123.58.176.224.80 > 192.168.108.16.55675: Flags [S.], > seq 3825658113, ack 2801603669, win 32768, options [mss 1400], length 0 > 02:04:38.145942 IP 220.181.8.27.80 > 192.168.108.16.59883: Flags [S.], > seq 918876111, ack 1103954263, win 32768, options [mss 1400], length 0 > 02:04:38.146083 IP 116.211.118.34.80 > 192.168.108.16.58487: Flags [S.], > seq 3760967127, ack 2050207109, win 32768, options [mss 1400], length 0 > 02:04:38.146084 IP 116.211.123.225.80 > 192.168.108.16.38705: Flags > [S.], seq 486747537, ack 3978733903, win 32768, options [mss 1400], length 0 > 02:04:38.146182 IP 116.211.123.225.80 > 192.168.108.16.38706: Flags > [S.], seq 3914276862, ack 930057259, win 32768, options [mss 1400], length 0 > 02:04:38.146332 IP 61.183.42.150.80 > 192.168.108.16.52172: Flags [S.], > seq 752539209, ack 2217414361, win 32768, options [mss 1400], length 0 > 02:04:38.146612 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [.], > ack 664, win 32917, length 0 > 02:04:38.154915 IP 221.235.187.76.80 > 192.168.108.16.52441: Flags [S.], > seq 4210760199, ack 2227559102, win 32768, options [mss 1400], length 0 > 02:04:38.182455 IP 117.21.179.38.80 > 192.168.108.16.34394: Flags [S.], > seq 375928677, ack 966252891, win 32768, options [mss 1400], length 0 > 02:04:38.209605 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [.], > seq 1:1461, ack 664, win 33580, length 1460 > 02:04:38.209610 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [P.], > seq 1461:1728, ack 664, win 33580, length 267 > 02:04:38.209918 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [.], > seq 1728:3188, ack 664, win 33580, length 1460 > 02:04:38.210901 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [.], > seq 3188:4648, ack 664, win 33580, length 1460 > 02:04:38.210911 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags > [FP.], seq 4648:5799, ack 664, win 33580, length 1151 > 02:04:38.212422 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [.], > ack 665, win 33580, length 0 > 02:04:38.226759 IP 116.211.123.225.80 > 192.168.108.16.38693: Flags [.], > ack 671, win 33248, length 0 > 02:04:38.228104 IP 116.211.123.225.80 > 192.168.108.16.38693: Flags [.], > seq 12030:13490, ack 671, win 33580, length 1460 > 02:04:38.228109 IP 116.211.123.225.80 > 192.168.108.16.38693: Flags [.], > seq 13490:14950, ack 671, win 33580, length 1460 > 02:04:38.228114 IP 116.211.123.225.80 > 192.168.108.16.38693: Flags > [P.], seq 14950:16182, ack 671, win 33580, length 1232 > 02:04:38.229573 IP 116.211.123.225.80 > 192.168.108.16.38694: Flags [.], > ack 1006, win 33249, length 0 > 02:04:38.229592 IP 116.211.123.225.80 > 192.168.108.16.38675: Flags [.], > ack 1368, win 33255, length 0 > 02:04:38.230891 IP 116.211.123.225.80 > 192.168.108.16.38675: Flags [.], > seq 16798:18258, ack 1368, win 33580, length 1460 > 02:04:38.230896 IP 116.211.123.225.80 > 192.168.108.16.38675: Flags > [P.], seq 18258:18783, ack 1368, win 33580, length 525 > 02:04:38.238474 IP 221.235.187.76.80 > 192.168.108.16.52400: Flags [.], > ack 2021, win 33255, length 0 > 02:04:38.239942 IP 119.97.146.47.80 > 192.168.108.16.44877: Flags [.], > ack 3069, win 33245, length 0 > 02:04:38.240068 IP 221.235.187.76.80 > 192.168.108.16.52400: Flags [.], > seq 40066:41526, ack 2021, win 33580, length 1460 > 02:04:38.240070 IP 221.235.187.76.80 > 192.168.108.16.52400: Flags [.], > seq 41526:42986, ack 2021, win 33580, length 1460 > 02:04:38.240073 IP 221.235.187.76.80 > 192.168.108.16.52400: Flags [P.], > seq 42986:43548, ack 2021, win 33580, length 562 > 02:04:38.240984 IP 119.97.146.47.80 > 192.168.108.16.44877: Flags [.], > seq 65226:66686, ack 3069, win 33580, length 1460 > 02:04:38.240989 IP 119.97.146.47.80 > 192.168.108.16.44877: Flags [P.], > seq 66686:67498, ack 3069, win 33580, length 812 > 02:04:38.241401 IP 221.235.187.76.80 > 192.168.108.16.52412: Flags [.], > ack 4028, win 33250, length 0 > > How can I go deep into the issue and resolve it? > > P.S. > I tried set "bind mss" parameters in the haproxy configration, but it > reported does not support on dfly. > > > > Regards > Simon >
