On Wed, Jun 25, 2008 at 09:21:21AM -0700, Gerald Combs wrote:
> I think Frank might be on the right track here. Inbound packets from
> 206.191.131.51 max out at 1018 bytes. This seems suspiciously low.
That's because the client asks for an MSS of 964 (see TCP options
in SYN packets). All the 1018 byte packets have exactly 964 bytes
TCP payload.
But that's no different between the two tcp-sessions towards the
server. Still, one fails, the other one doesn't.
One thing I have came accross before is servers that allow only one
tcp session per src-ip. But in those cases the three way handshake
would already fail, which is not the case in the problem at hand...
Cheers,
Sake