> Make tcpdump on troika too.
>
> (If it is the same bug that I know, the result will be exciting)
Here you have the tcpdump on the two machines, for the same
command, given on sirio:
rcp tcpbug.dat troika:
and blocked with a INTR after ten seconds.
At the end of commands, the status of the connection on the two machines
are (sirio: kernel 2.0.28, troika: kernel 2.0.25)
sirio:
tcp 0 52965 sirio.iet.unipi.i:1023 troika.iet.unipi:shell FIN_WAIT1
troika:
tcp 0 0 atropo.iet.unipi:shell sirio.iet.unipi.i:1023 ESTABLISHED
Here are the two dumps, without folding lines (I hope this way is
better):
******** sirio TCPDUMP **********
[root@sirio /tmp]# tcpdump host troika and sirio
tcpdump: listening on eth0
12:04:30.734893 sirio.iet.unipi.it.1042 > troika.iet.unipi.it.domain: 1+ (37)
12:04:30.734893 troika.iet.unipi.it.domain > sirio.iet.unipi.it.1042: 1* 2/2/2 (164)
12:04:45.654893 troika.iet.unipi.it.netbios-ns > sirio.iet.unipi.it.netbios-ns: udp 62
12:04:54.424893 sirio.iet.unipi.it.1044 > troika.iet.unipi.it.domain: 1+ (37)
12:04:54.424893 troika.iet.unipi.it.domain > sirio.iet.unipi.it.1044: 1* 2/2/2 (164)
12:04:54.434893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: S 3549078602:3549078602(0) win 512 <mss 1460>
12:04:54.434893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: S 3461199526:3461199526(0) ack 3549078603 win 15360 <mss 1460>
12:04:54.434893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . ack 1 win 31744
12:04:54.474893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 1:2(1) ack 1 win 31744 (DF)
12:04:54.494893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 2 win 15360
12:04:54.514893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 2:9(7) ack 1 win 31744 (DF)
12:04:54.524893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 9 win 15360
12:04:54.544893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 9:16(7) ack 1 win 31744 (DF)
12:04:54.564893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 16 win 15360
12:04:54.564893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 16:25(9) ack 1 win 31744 (DF)
12:04:54.574893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 25 win 15360
12:04:54.844893 troika.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: S 1844758878:1844758878(0) win 512 <mss 1460>
12:04:54.844893 sirio.iet.unipi.it.auth > troika.iet.unipi.it.1446: S 2200823371:2200823371(0) ack 1844758879 win 31744 <mss 1460>
12:04:54.844893 troika.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: . ack 1 win 15360
12:04:54.864893 troika.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: P 1:11(10) ack 1 win 15360 (DF)
12:04:54.884893 sirio.iet.unipi.it.auth > troika.iet.unipi.it.1446: . ack 11 win 31744
12:04:55.054893 sirio.iet.unipi.it.auth > troika.iet.unipi.it.1446: P 1:38(37) ack 11 win 31744 (DF)
12:04:55.074893 troika.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: . ack 38 win 15360
12:04:55.084893 troika.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: F 11:11(0) ack 38 win 15360
12:04:55.084893 sirio.iet.unipi.it.auth > troika.iet.unipi.it.1446: . ack 12 win 31744
12:04:55.124893 sirio.iet.unipi.it.auth > troika.iet.unipi.it.1446: F 38:38(0) ack 12 win 31744
12:04:55.124893 troika.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: . ack 39 win 15360
12:04:55.644893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: P 1:2(1) ack 25 win 15360 (DF)
12:04:55.664893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . ack 2 win 31744
12:04:56.234893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: P 2:3(1) ack 25 win 15360 (DF)
12:04:56.254893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . ack 3 win 31744 [tos 0x8]
12:04:56.264893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 25:49(24) ack 3 win 31744 (DF) [tos 0x8]
12:04:56.264893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: P 3:4(1) ack 49 win 15360 (DF)
12:04:56.284893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . ack 4 win 31744 [tos 0x8]
12:04:56.314893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 49:1509(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.314893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 1509:2969(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.324893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 2969 win 14336
12:04:56.324893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 2969:4145(1176) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.334893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 4145:5605(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.334893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 5605:7065(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.344893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 7065 win 14336
12:04:56.344893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 7065:8241(1176) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.354893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 8241:9701(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.354893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 9701:11161(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.364893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 11161:12621(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.364893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 12621:14081(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.364893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 14081:15541(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.364893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 11161 win 12288
12:04:56.374893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 15541 win 9216
12:04:56.374893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 15541:16433(892) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.384893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 16433:17893(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.384893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 17893:19353(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.394893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 19353:20813(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.394893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 20813:22273(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.394893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 22273:23733(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.394893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 7168
12:04:56.394893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 7168
12:04:56.404893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 23733:25193(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.404893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 7168
12:04:56.554893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.554893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 25193:26653(1460) ack 4 win 31744 [tos 0x8]
12:04:56.554893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 26653:28113(1460) ack 4 win 31744 [tos 0x8]
12:04:56.554893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 28113:29573(1460) ack 4 win 31744 [tos 0x8]
12:04:56.554893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 29573:31033(1460) ack 4 win 31744 [tos 0x8]
12:04:56.554893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 31033:32493(1460) ack 4 win 31744 [tos 0x8]
12:04:56.554893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.554893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.554893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.554893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.554893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.594893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 19353:20813(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.754893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.994893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 19353:20813(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:57.794893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 19353:20813(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:59.394893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: P 19353:20813(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:59.404893 troika.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 20813 win 12876
12:04:59.404893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 20813:22273(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:59.594893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 20813:22273(1460) ack 4 win 31744 (DF) [tos 0x8]
12:05:05.994893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 20813:22273(1460) ack 4 win 31744 (DF) [tos 0x8]
12:05:18.794893 sirio.iet.unipi.it.1023 > troika.iet.unipi.it.shell: . 20813:22273(1460) ack 4 win 31744 (DF) [tos 0x8]
80 packets received by filter
0 packets dropped by kernel
********* TROIKA TCPDUMP **********
Script started on Mon Mar 3 11:03:39 1997
[root@troika /tmp]# /usr/sbin/tcpdump host troika and sirio
tcpdump: listening on eth0
12:04:30.656393 sirio.iet.unipi.it.1042 > atropo.iet.unipi.it.domain: 1+ (37)
12:04:30.656393 atropo.iet.unipi.it.domain > sirio.iet.unipi.it.1042: 1* 2/2/2 (164)
12:04:45.586393 atropo.iet.unipi.it.netbios-ns > sirio.iet.unipi.it.netbios-ns: udp 62
12:04:54.356393 sirio.iet.unipi.it.1044 > atropo.iet.unipi.it.domain: 1+ (37)
12:04:54.356393 atropo.iet.unipi.it.domain > sirio.iet.unipi.it.1044: 1* 2/2/2 (164)
12:04:54.356393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: S 3549078602:3549078602(0) win 512 <mss 1460>
12:04:54.356393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: S 3461199526:3461199526(0) ack 3549078603 win 15360 <mss 1460>
12:04:54.366393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . ack 1 win 31744
12:04:54.406393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 1:2(1) ack 1 win 31744 (DF)
12:04:54.426393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 2 win 15360
12:04:54.436393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 2:9(7) ack 1 win 31744 (DF)
12:04:54.456393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 9 win 15360
12:04:54.466393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 9:16(7) ack 1 win 31744 (DF)
12:04:54.486393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 16 win 15360
12:04:54.486393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 16:25(9) ack 1 win 31744 (DF)
12:04:54.506393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 25 win 15360
12:04:54.776393 atropo.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: S 1844758878:1844758878(0) win 512 <mss 1460>
12:04:54.776393 sirio.iet.unipi.it.auth > atropo.iet.unipi.it.1446: S 2200823371:2200823371(0) ack 1844758879 win 31744 <mss 1460>
12:04:54.776393 atropo.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: . ack 1 win 15360
12:04:54.786393 atropo.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: P 1:11(10) ack 1 win 15360 (DF)
12:04:54.806393 sirio.iet.unipi.it.auth > atropo.iet.unipi.it.1446: . ack 11 win 31744
12:04:54.986393 sirio.iet.unipi.it.auth > atropo.iet.unipi.it.1446: P 1:38(37) ack 11 win 31744 (DF)
12:04:55.006393 atropo.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: . ack 38 win 15360
12:04:55.006393 atropo.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: F 11:11(0) ack 38 win 15360
12:04:55.006393 sirio.iet.unipi.it.auth > atropo.iet.unipi.it.1446: . ack 12 win 31744
12:04:55.046393 sirio.iet.unipi.it.auth > atropo.iet.unipi.it.1446: F 38:38(0) ack 12 win 31744
12:04:55.046393 atropo.iet.unipi.it.1446 > sirio.iet.unipi.it.auth: . ack 39 win 15360
12:04:55.576393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: P 1:2(1) ack 25 win 15360 (DF)
12:04:55.586393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . ack 2 win 31744
12:04:56.166393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: P 2:3(1) ack 25 win 15360 (DF)
12:04:56.176393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . ack 3 win 31744 [tos 0x8]
12:04:56.186393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 25:49(24) ack 3 win 31744 (DF) [tos 0x8]
12:04:56.196393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: P 3:4(1) ack 49 win 15360 (DF)
12:04:56.206393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . ack 4 win 31744 [tos 0x8]
12:04:56.246393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 49:1509(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.246393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 1509:2969(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.256393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 2969 win 14336
12:04:56.256393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 2969:4145(1176) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.266393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 4145:5605(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.266393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 5605:7065(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.276393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 7065 win 14336
12:04:56.276393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 7065:8241(1176) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.286393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 8241:9701(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.286393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 9701:11161(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.296393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 11161 win 12288
12:04:56.296393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 11161:12621(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.296393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 12621:14081(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.296393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 14081:15541(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.306393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 15541 win 9216
12:04:56.306393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 15541:16433(892) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.316393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 16433:17893(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.316393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 17893:19353(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.326393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 7168
12:04:56.326393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 22273:23733(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.326393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 7168
12:04:56.326393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 23733:25193(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:56.326393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 7168
12:04:56.476393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.486393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 25193:26653(1460) ack 4 win 31744 [tos 0x8]
12:04:56.486393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.486393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 26653:28113(1460) ack 4 win 31744 [tos 0x8]
12:04:56.486393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.486393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 28113:29573(1460) ack 4 win 31744 [tos 0x8]
12:04:56.486393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.486393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 29573:31033(1460) ack 4 win 31744 [tos 0x8]
12:04:56.486393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.486393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: . 31033:32493(1460) ack 4 win 31744 [tos 0x8]
12:04:56.486393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:56.686393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 19353 win 14336
12:04:59.316393 sirio.iet.unipi.it.1023 > atropo.iet.unipi.it.shell: P 19353:20813(1460) ack 4 win 31744 (DF) [tos 0x8]
12:04:59.336393 atropo.iet.unipi.it.shell > sirio.iet.unipi.it.1023: . ack 20813 win 12876
71 packets received by filter
0 packets dropped by kernel
Script done on Mon Mar 3 11:05:16 1997
***********************
Something interesting?
Romano
------------------------------------------------------------------
Dr. Romano Giannetti Dip. di Ingegneria dell'Informazione
Researcher Elettronica Informatica Telecomunicazioni
romano@iet.unipi.it University of Pisa
------------------------------------------------------------------