Re: [tcpm] TCP zero window timeout?

At 21:00 25/08/2006, Mahesh Jethanandani wrote:

>The situation I was referring to is a little different and applies 
>to persist timer. In our situation the client stops reading data. 
>These clients are machines out in the Internet and as such the 
>server has no control over their behavior. So while there is 
>unacknowledged data, it is not that the client is not acking any 
>data. It is responding to the probe but that it continuously 
>advertises a window of zero.  There is currently to my knowledge no 
>timeout for this state for the server. This can manifest itself as a 
>DOS situation if there are several such connections where the server 
>is forced to hold data.

I'd argue that this should be handled by an application-level timer.

The problem with the scenario you point out is that there will always 
be one more way to do the same thing.

If we're talking about connections wasting resources, there are many 
protocols (POP3, SMTP) in which after the initial greeting by the 
server, the client is supposed to go ahead. In all those cases, the 
client could just sit there. And only an application-layer timeout 
would help you.

I'm not sure how many servers implement this type of 
application-layer timer. But there are some (Apache) that I have 
checked, and do.

Nevertheless, I'm interested in the behaviour you described. Is it 
supposed to be malicious activity?

Kindest regards,

--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1