My current Server: Redhat AS Release3 2.4.21-4.ELsmp #1 SMP
I recieve lots of message as below:
CP: Treason uncloaked! Peer 203.12.220.228:30112/80 shrinks window
3165578735:3165581495. Repaired.
TCP: Treason uncloaked! Peer 203.12.220.221:59131/80 shrinks window
76154906:76154907. Repaired.
TCP: Treason uncloaked! Peer 203.12.220.227:39670/443 shrinks window
280180313:280180314. Repaired.
TCP: Treason uncloaked! Peer 203.12.220.227:39670/443 shrinks window
280180313:280180314. Repaired.
TCP: Treason uncloaked! Peer 203.12.220.227:39670/443 shrinks window
280180313:280180314. Repaired.
TCP: Treason uncloaked! Peer 203.12.220.237:53759/80 shrinks window
283676616:283676617. Repaired.
TCP: Treason uncloaked! Peer 203.12.220.237:36407/80 shrinks window
352393585:352393586. Repaired.
TCP: Treason uncloaked! Peer 203.12.220.237:38616/443 shrinks window
529411143:529411144. Repaired.
TCP: Treason uncloaked! Peer 58.139.248.9:7611/443 shrinks window
2279076446:2279076447. Repaired.
The error make my web server slow until unable to browse. Below is top
command output before or after this error appear.
15:02:05 up 2:59, 3 users, load average: 124.79, 50.31, 21.01
317 processes: 233 sleeping, 84 running, 0 zombie, 0 stopped
CPU states: cpu user nice system irq softirq iowait idle
total 96.9% 0.0% 2.0% 0.1% 0.8% 0.0% 0.0%
cpu00 94.2% 0.0% 2.3% 0.6% 2.7% 0.0% 0.0%
cpu01 97.5% 0.0% 2.3% 0.0% 0.1% 0.0% 0.0%
cpu02 97.8% 0.0% 1.9% 0.0% 0.1% 0.0% 0.0%
cpu03 98.1% 0.0% 1.6% 0.0% 0.2% 0.0% 0.0%
Mem: 3611320k av, 1031284k used, 2580036k free, 0k shrd, 32868k
buff
801868k active, 128828k inactive
Swap: 2096472k av, 0k used, 2096472k free 184300k
cached
Question:
1- What could be the problem and how to solve this? Is it a kernel related
problem?.
2- I know in it's definition, it mean some kinda low dos attack.
3- How to create/simulate this error to my server, because I want to learn how it happen.
p/s: I have google and search around but all are only definition of Treason Uncloaked but there is no solution or the cause.
Thank you.
Try blocking the bad users using iptables
If this is caused by sending strange packets that consume kernel memory, perhaps adding some of these attacker IP addresses to an iptables rule to drop the packets would help. The attacker(s) will probably keep moving to another IP address, so you have get a script to read the logs ("grep Treason") and add new blocking rules to iptables (maybe your old system uses 'ipchains' instead).
There have been many iptables rule additions and enhancements in the 2.6 kernel, maybe around 2.6.15 (current version is 2.6.18). Perhaps this problem does not exist in a modern Linux system with kernel 2.6.18, current Apache, etc..
Setting up a web server is so trivial in Debian:
apt-get install apache2 mysql php5
what kinda iptables line form
what kinda iptables line format that can grab the ip from dmesg of treason uncloaked error?...because the error is appear on running server when we type dmesg at the console and not the /var/log/dmesg
can you give me a sample line of iptables that block ip from dmesg treason uncloaked error?
thanks
Simple version, untested
#!/bin/bash
for ATTACKER_IP in $(dmesg | grep 'Treason uncloaked!' | cut -d' ' -f5 | cut -d':' -f1 | sort --unique)
do
iptables -A INPUT -s $ATTACKER_IP -j DROP
done
anyone know how to simulate t
anyone know how to simulate this error? i need to learn how it actually work...i have test server to act as victim. from there i can learn layer by layer how it be done or either it is an attack or not an attack.
BE VERY CAREFUL
I got to this page because I'm investigating a case where I get this error for communication between (trusted) processes (Apache and Memcached) on the same server. Obviously something is wrong, but if I'd run the above script it would completely disrupt communication on our server.
Vidar
complex version, use at your own risk
The below script may work a little better... Note that you'll need a rule in your firewall script to create the TREASON rule set, and jump to it in the beginning, and make a cronjob to run the script so it's automagic.
Something like the following should be in your main firewall script:
---cut---
iptables -F TREASON
iptables -X TREASON
iptables -N TREASON
... (your rest of the rules)
iptables -j TREASON # insert before state established and other lines
---cut---
Then, the below script should be in a cronjob (run once every whatever interval you feel fit).
---cut---
#!/bin/bash
# Stupid shell script to stop stupid TCP Treason attacks
# Setup cronjob to stop them
# First, flush and clean Treason rules
iptables -F TREASON
#iptables -X TREASON
#iptables -N TREASON
for ATTACKER_IP in $(dmesg | grep 'Treason uncloaked!' | cut -d' ' -f5 | cut -d':' -f1 | sort --unique)
do
FOUNDIT=0
for DONTBLOCK in $(route -n | grep -v Destination | grep -v Kernel | awk '{print $2}' | sort | uniq && ifconfig -a | grep inet | cut -f 2 -d ':' | cut -f 1 -d ' ' | sort | uniq)
do
# echo "Checking $DONTBLOCK against $ATTACKER_IP ..."
if [ "$DONTBLOCK" = "$ATTACKER_IP" ]; then
# echo "UHOH! Hacker using forged local IP! Don't block it!"
FOUNDIT=1
fi
done
if [ "$FOUNDIT" = "0" ]; then
# echo "Hacker IP $ATTACKER_IP not found in don't block list... Dropping"
iptables -A TREASON -s $ATTACKER_IP/32 -j DROP
fi
done
iptables -A TREASON -j RETURN
---cut---
Kernel bug believed to cause this problem
Have a look at this page:
http://linux.derkeiler.com/Mailing-Lists/Kernel/2006-03/msg03750.html
These folks seem to have found that a bug in the kernel is causing these messages rather than an attacker. If that's the case, our adding rules to the firewall to block those IPs will cut off users of our sites that probably aren't doing anything wrong.
Best,
Mike
Problem exists across multiple kernels
If this is a bug in the Linux kernel, I'm suprised so many websites are still up and functioning. We were on Fedora Core 5 (kernel version 2.6.16), and are now on Mandriva Linux 2007 (kernel version 2.6.17), and this problem has followed us in our distro transition.
It's an attack, not a kernel bug
In my server's demsg, I see this:
The IPs are also from India. The home page of my HTTPS server has nothing but a logon box on the very first page which allows only my customers to enter. But none of my customers is from India. So the message must not be triggered by a kernel bug but an attack (unless the IPs were logged incorrectly....)
The other comment thread is
The other comment thread is wrong.
The problem is that a router somewhere along the way to your box does not properly support tcp window scaling.
This error is harmless, you can ignore it.
Server crash is not "harmless".
If you read these threads and others elsewhere you will often see "examined dmesg after my server CRASHED/hung and found 'treason uncloaked'". I doubt many running web servers can 'safely ignore' a crash.
Looking at the kernel source that is the root of the problem, it is not very good, and it appears that anything from a badly implemented Dlink print server to a script kiddie trying to do a DOS on a game server using this weak kernel TCP window scaling code can lead to the problem. Furthermore, the crappy code is still basically unchanged even up to kernel 2.6.21.1 even.
So the recommendation to block 'attackers' (where 'attacker' does not imply malicious intent, it could be a Dlink print server, for example) with iptables seems still valid until someone writes better kernel code. I hope the rest of the kernel isn't coded like that section.
Looking at one trace we see a known spambot IP address from India trying ports 80, 1080, 23 (telnet), each time triggering 'treason uncloaked'. This does not seem very 'harmless' to me.
> Looking at one trace we
> Looking at one trace we see a known spambot IP address
> from India trying ports 80, 1080, 23 (telnet), each time
> triggering 'treason uncloaked'.
> This does not seem very 'harmless' to me.
The portscan is the "dangerous" part.
The tcp window scaling error is not dangerous at all.
What a dumbass A router that
What a dumbass
A router that doesnt support tcp window scaling HAHAHAHAHAH.
Yeah I have a ethernet cable here that doesnt support the IP protocol it only accepts IPX.
dumb indeed...
http://lwn.net/Articles/92727/ 5th paragraph
Where is the original poster
Where is the original poster with his rhetorical limited network cable? Hmmmm? :-)
Explanation
The error message say it all. Learn to read.
This is not causing the webserver slowness, or any crashes. Nor is it a kernel bug! What happens is that a client tries to shrink the TCP window. This would not be catastrophic anyway, BUT your kernel ignores/prevents this, so it should have absolutely no effect. That's why it says "Repaired." at the end.
It could be a broken router or broken/old OS on a hacked machine that is used for portscanning. It's not an attack because it does nothing, even if the kernel didn't prevent this all it would do is slow down the speed at which the server sends out data on that particular connection. Slow send can cause more overall Apache processes, but if you only see this a couple of times it's probably not an attack. Anyways, in 2007 nobody should use the preforking Apache MPM.
"Repaired" how quickly?
I think the problem is not the error recovery code is not there, but that is is not fast enough and robust enough to handle a lot of these "window shrinkages". "Repaired", but how quickly?
Normally I am the first to recommend all the latest code. That means Apache 2.2.4 and kernel 2.6.21.1 (as of 20070511). I'd like to see if anyone gets these problems with that combination.
I know that instead, people set up so-called "Enterprise" web servers running old kernels and old 1.3.X Apache (their "management" feels much more supported and would forbid anything else). I agree that those who do that deserve to crash, and should contact their so-called "enterprise support" when they get a crash. However, Apache is userspace and there are people reporting hangs/crashes with kernel 2.6.21. We are all reassured now by you that the old Apache causing these problems, perhaps that's why telnet port 23 can also shrink the TCP window?
The only reason for agreeing with you is that major enterprises rely on Linux web servers and if they could all be brought down by "treason uncloaked" then they would be, and they would demand an immediate fix. So perhaps a web server listening only on ports 80 and 443 is immune. Or maybe one with the kernel built properly, without enabling every single feature as "Y" or "M"? (i.e. Redhat, Suse, etc. "Enterprise").
Any moron who has port 23 open for telnet on a web server does deserve to crash.
So shame on all of you who are running web servers with old, so-called "stable enterprise" code. "Mr. Anonymous" tells us that your server crash is either caused by running old "stable" code, or that your crash "doesn't matter". I just wonder if Mr. Anonymous lives in Rumania, in charge of the spambot/phishing/identity theft project ... Don't try to fix the "treason uncloaked" problem, he needs this vulnerability to feed his family.
?
Whoa, dude, take it easy :)
And besides, there is no such place called "Rumania". Finally, I don't really see any connection between the "shrinking TCP window" DoS possibility and spambotting/identity theft.
Perhaps you need to relax and drink a nice cup of tea. No need to be so paranoid :)
> all be brought down by
> all be brought down by "treason uncloaked" then they would be
Stop being paranoid, and look at the problem. This message means tcp window scaling isn't working at the other end.
It has nothing to do with apache servers.
> or that your crash "doesn't matter
The crash matters, the irrelevant reference to Apache does not.
> just wonder if Mr. Anonymous lives in Rumania, in
> charge of the spambot/phishing/identity theft project
Don't be racist, and stop scare mongering.
Treason uncloaked
Well, by preforking Apache I didn't mean 1.3.x, but the default config of Apache 2.x as the Enterprise vendors ship it. The threaded MPM is also stable and more resistant to dos.
As for a crash, everyone's logs are filled with these Treason uncloaked messages, that doesn't mean it caused the crash. My server logs have 3 million such lines and yet it never crashed. From looking at the code it seems impossible that it would crash there. To properly debug a crash, at least obtain a backtrace from the kernel coredump, or just call "Enterprise support" :-P
Of course crashes matter but I'd bet 50000 Rumanian lei that it's not in the TCP window scaling code.
I have had the same problem
I have had the same problem on my cheap home server with Debian Linux 2.6.18-4-686 and Apache 2.2.3-4 (latest in Debian Testing). I suspect it IS caused by DOS attacks, though I wouldn't know why someone would like to do that.
For me, doing a "/etc/init.d/apache2 stop" solved the problem once, though it toke 5 minutes to execute the stop.
hi I have had the same
hi
I have had the same problem on my production server which is 2.6.18-4-amd64 #1 SMP and Apache/2.2.3 stable. When i saw this in logs apache started to slowing down and stop responding...
I see tons of these on both
I see tons of these on both of my servers and have never had a the server stop responding or lag or anything so I think these are harmless. I really thought it was because of my web100 kernel patch but I guess not. One of my servers got tons of these a day and had a 150 day uptime. Here is my dmesg output:
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 902441831:902442102. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 902441831:902442102. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 922677026:922679922. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1033491688:1033499678. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1043315140:1043318036. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1101206871:1101209767. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1123193866:1123196762. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1143486725:1143495142. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1174672196:1174675092. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1211268858:1211271483. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1230138017:1230139735. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1230138017:1230139735. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1239649763:1239651211. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1251096578:1251098401. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1261057743:1261059566. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1281436071:1281441863. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1281436071:1281441863. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1287763508:1287774342. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1300567657:1300569480. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1318442999:1318444656. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1348431600:1348433423. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1356848893:1356850768. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1356848893:1356850768. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1360100674:1360108987. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1414010246:1414020740. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1439359966:1439362862. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1445606416:1445623648. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1445606416:1445623648. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1458994302:1459002990. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1469637140:1469645828. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1476801168:1476806960. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1487670921:1487673817. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1491287497:1491299081. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1540839014:1540851663. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1542427198:1542430094. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1555322090:1555336570. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1591335665:1591353041. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1599418465:1599426958. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1601746934:1601764357. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1623923481:1623940264. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1634082765:1634096898. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1640915728:1640931641. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1650376796:1650385484. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1659326256:1659338135. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1665760202:1665768890. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1679628087:1679630983. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1708048010:1708064261. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1731133519:1731142207. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1750791967:1750802540. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1782307141:1782323444. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1792806497:1792823354. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1792806497:1792823354. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1855353423:1855361114. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1855353423:1855361114. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1859948135:1859949208. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1859948135:1859949208. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1924175688:1924201918. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1932798775:1932810359. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1945080228:1945086020. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1949916276:1949920245. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1957637388:1957651868. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1969774131:1969790083. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1969774131:1969790083. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1974023579:1974032267. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 1980244365:1980249986. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 2097795899:2097798795. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 2097795899:2097798795. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 2105185043:2105190835. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 2105185043:2105190835. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 2106481003:2106483899. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 2124906532:2124915220. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 2140233612:2140236508. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 2140233612:2140236508. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 2153238100:2153240621. Repaired.
TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468 shrinks window 2233865500:2233874188. Repaired.
TCP: Treason uncloaked! Peer 81.216.211.183:52931/35953 shrinks window 211572868:211591692. Repaired.
TCP: Treason uncloaked! Peer 81.216.211.183:52931/35953 shrinks window 520053941:520075005. Repaired.
TCP: Treason uncloaked! Peer 81.216.211.183:61082/56941 shrinks window 1769093122:1769146106. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2841199785:2841205425. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2843950341:2843950500. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2848764556:2848767376. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2851677999:2851680819. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2855836837:2855838333. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2860302829:2860305649. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2862967285:2862970840. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2867244768:2867247588. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2871980317:2871983137. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2877116649:2877119469. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2877392949:2877395769. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2880978567:2880981387. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2881716432:2881719252. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2891843096:2891845916. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2896486463:2896489283. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2896817190:2896819335. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2918700666:2918703486. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2933593691:2933596511. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2955734084:2955739724. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2957742455:2957745275. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2960926350:2960926754. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2969074048:2969076868. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2976749818:2976749871. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2976749818:2976749871. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2976749818:2976749871. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 2988846026:2988848846. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3009600100:3009602245. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3009600100:3009602245. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3009600100:3009602245. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3014116541:3014119361. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3018493604:3018496424. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3023674332:3023677152. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3064006432:3064009252. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3069012429:3069015249. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3076062243:3076065063. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3081295727:3081297223. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3092554675:3092556820. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3094458660:3094464022. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3095870159:3095872979. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3103760725:3103761129. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3103760725:3103761129. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3103760725:3103761129. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3130640863:3130643683. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3159939347:3159950627. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3172173934:3172179574. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3174153098:3174153502. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3182109358:3182114998. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3189480541:3189482216. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3193042609:3193042854. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3198583025:3198585567. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3200313647:3200316467. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3203254032:3203265312. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3215789109:3215795484. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3216742944:3216748584. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3224605599:3224607744. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3232004516:3232012976. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3239330583:3239333403. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3253410041:3253415681. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3256776169:3256778029. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3258464742:3258466920. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3272047629:3272053269. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3281711527:3281717167. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3290072174:3290074994. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953 shrinks window 3290403457:3290406277. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 539851714:539854534. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 549573104:549575924. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 552525101:552527921. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 555486633:555489453. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 557469115:557474755. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 563633007:563635827. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 572570096:572572916. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 572829536:572835176. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 577074709:577077456. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 580588993:580597453. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 591208567:591211387. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 593798240:593799710. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 601972358:601980818. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 603749983:603752128. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 610004357:610007177. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 618038539:618041359. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 618236614:618241155. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 620474605:620477425. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 630364563:630367383. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 640978547:640986067. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 648262586:648265406. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 661990962:661996602. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 664684346:664692806. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 678099282:678099441. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 678099282:678099441. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 679886661:679887396. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 680820211:680825851. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 686332414:686338054. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 688193066:688199997. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 714260710:714266350. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 736633046:736635866. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 743428152:743435937. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 762806322:762809142. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 763554872:763558487. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 784856351:784856411. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 821838870:821844510. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 831407560:831410380. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 835196743:835199563. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 835936984:835953904. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 847823844:847824870. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 853518340:853523980. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 860333088:860344368. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 861680237:861685877. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 877762174:877764259. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 881185986:881193096. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 911405881:911419981. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 915338123:915343088. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 945964087:945964822. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 964870991:964876631. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 974160040:974162185. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 982438882:982443847. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 997352284:997355104. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1003380234:1003383054. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1008000721:1008005686. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1029210994:1029216634. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1030069027:1030077619. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1034509798:1034512618. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1041347029:1041349849. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1062055038:1062066318. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1091932836:1091935656. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1108666015:1108677295. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1110444726:1110447546. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1117260447:1117263267. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1132221009:1132226649. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1147824467:1147832927. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1162717717:1162723357. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1197147468:1197153108. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1227467841:1227470661. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1253260045:1253262865. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1297923682:1297925827. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1327749022:1327754662. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1384644824:1384646525. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1386013818:1386015288. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1412053457:1412056277. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1417917696:1417920516. Repaired.
TCP: Treason uncloaked! Peer 217.42.4.167:55137/35953 shrinks window 3287617829:3287620725. Repaired.
TCP: Treason uncloaked! Peer 217.42.4.167:55137/35953 shrinks window 3423799797:3423801249. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1441789356:1441790124. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1477687866:1477692096. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1517597146:1517605606. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1545584916:1545587736. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1579709195:1579713875. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1585329083:1585331903. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1604645174:1604645260. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1625140340:1625141518. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1631847651:1631853291. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1673315871:1673318691. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1714193052:1714203042. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1733163188:1733166008. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1749184892:1749187712. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1760519831:1760522651. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1793930915:1793933166. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1872072215:1872075035. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1905248005:1905250825. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1926110641:1926113461. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 1961976267:1961981907. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 2011746890:2011749710. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 2017887150:2017889295. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 2028195022:2028196359. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 2050976117:2050978937. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 2076350066:2076351476. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 2114745093:2114747913. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 2122148127:2122150947. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 2127197345:2127202985. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 2182834013:2182836833. Repaired.
TCP: Treason uncloaked! Peer 172.212.202.146:63018/35953 shrinks window 2189895484:2189901124. Repaired.
restart my system ....
Linux darkstar 2.6.22.4-65.fc7
==============================
ip_tables: (C) 2000-2006 Netfilter Core Team
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (8189 buckets, 65512 max)
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682383966:1682386686. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682383966:1682386686. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682383966:1682386686. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682383966:1682386686. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682401646:1682403006. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682401646:1682403006. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682401646:1682403006. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682419326:1682422046. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682419326:1682422046. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682419326:1682422046. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682419326: 1682422046. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682560766: 1682562126. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682560766:1682562126. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682560766: 1682562126. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682560766:1682562126. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682613806: 1682616526. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682613806: 1682616526. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682613806: 1682616526. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682702206: 1682704926. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682702206: 1682704926. Repaired.
TCP: Treason uncloaked! Peer 85.53.217.170:54576/4662 shrinks window 1682702206: 1682704926. Repaired.
and after five minutes, my machine has not connection
to outerspace, no http, no ftp, ... all blocked?
and renew my dhcp connection and nothing working ..
but other pc connected to the same router still working (windows xp !) without problem (seagate firewall shows messages about tcp headers ...)
It gets that i have to restart my fedora system.
stop fullquoting, save the puppies!
uh, why the fullquote?
[snip]
> Here is my dmesg output:
> TCP: Treason uncloaked! Peer 81.154.128.15:1623/54468
> shrinks window 902441831:902442102. Repaired.
> TCP: Treason uncloaked! Peer 172.212.202.146:60287/35953
> shrinks window 2960926350:2960926754. Repaired.
does your server listen on :54468 or :35953? if not, then whatever hits the wire and generating these messages does not affect your webserver.
if one is curious about the other end:
# dmesg | awk '/Treason/ {print $5}' | \
sed 's/:/ /;s/\/.*$//' | sort -u | xargs nc -vw1
Ignore the error - that may be a TARPIT
This message, from 2002, has still a perfectly valid explaination. The guy grepped the kernel source code for the message and read the comment.
I double-checked and that code is still there.
http://lists.debian.org/debian-isp/2002/04/msg00192.html
Then, I got this message as well, very often, but my computer is still perfectly operational, and the current upload bandwidth usage is 2Megabyte/s. So, the message is not harmful. Ignore it.
I think I'm getting it because of the huge amount of data I'm sending. That's expected if I fill the network buffers on the receiver (which must then shrink the receive window), packets are lost, and the TCP retrasmit timer gets called before the receiver could process incoming data.
If you have problems, they are due to something else. Since the message is unlikely, it's likely to get it only if you communicate with a huge amount of cliens/peers, so something else is slowing down your webserver. Btw, what does it mean "the top output BEFORE OR AFTER the error appears"???
For instance, this guy was caught by the same misunderstanding. BUT, he looked a lot of tuning guides, so you may look at them.
http://www.informedbanking.com/acc/nxwiki/view/TCP-Treason-Uncloaked.htm...
In my opinion, there is a (somewhat) easy way to reproduce the problem. Connect to your webserver something to tarp it. There are solutions for this already made (there's a TARPIT target in iptables: connect to the webserver from some program, and then make sure to run the TARPIT target on the client and to make it match that connection. For instance, adding a rule matching with the webserver as destination, with -d, and with -j TARPIT, should do the job).
Otherwise, below there's another recipe. But I think TARPIT does exactly the same in a simpler way.
Write in any programming language with access to BSD socket calls (also Python) a program which connects to your webserver (port 80), writes a simple GET request for a huge file on the server, and then just sleeps, without reading the reply. Run this program on a machine where you lower the TCP receiving buffer, if possible I don't know which tunable to use). The client will finish the space in the buffer, and tell the server to wait before sending more data, without letting it continue. You should get this error.
The code is in tcp_timer.c ,
The code is in tcp_timer.c , see this on koders.com
http://koders.com/default.aspx?s=TCP+Treason+Uncloaked&btn=&la=*&li=*&p=...