Re: Ipfilter keep state can't handle Linux TCP window scaling 7

ming fu wrote:
> Hi,
>
> I tried on FreeBSD 10 and FreeBSD 11
>
> Linux 2.6.8 --> ipfilter/FreeBSD 4.10 -> FreeBSD 5.4
>
> ssh from Linux to FreeBSD 5.4 with rule on the ipfilter/FreeBSD 4.10
> box in the middle.
>
> pass in quick on lnc0 proto tcp from 10.1.0.0/16 to 172.31.0.0/16 port
> = 22 flags S keep-state
>
> The Linux box is on the 10.1.0.0 and FreeBSD 5.4 on the 172.31.0.0.
>
> Once the Linux sets the TCP window scale to 7 (TCP option 3), the ssh
> will stall and then reset under some load. The SSH login and a few
> "ls" command worked fine.

It sounds like IPFilter needs to be updated

You should be using at least 4.1.10

Darren