out of order tcp packets?

tiwang — Mon, 11 Mar 2019 21:12:23 GMT

hi out there

We have been digging a bit in "bad" http throughput at some sites through our ASA 5510/5520'eres - the boxes itself are not that loaded so that we would expect bad througput but some sites load very slow thorugh these boxes and through the "show asp" command I can see that we drop packets in a out of order que (ok - those dropped are dups accoring to the description):

gw# sh asp drop frame

No valid adjacency (no-adjacency) 3531

Reverse-path verify failed (rpf-violated) 47101

Flow is denied by configured rule (acl-drop) 505169

First TCP packet not SYN (tcp-not-syn) 1525

TCP failed 3 way handshake (tcp-3whs-failed) 3472

TCP RST/FIN out of order (tcp-rstfin-ooo) 4952

TCP SEQ in SYN/SYNACK invalid (tcp-seq-syn-diff) 2

TCP packet SEQ past window (tcp-seq-past-win) 131

TCP RST/SYN in window (tcp-rst-syn-in-win) 6

TCP dup of packet in Out-of-Order queue (tcp-dup-in-queue) 50654

TCP packet failed PAWS test (tcp-paws-fail) 24

Slowpath security checks failed (sp-security-failed) 21401

FP L2 rule drop (l2_acl)

We have not defined any tcp-map to handle these our-of-order packets - but how is default behavior of the ASA for packets received a bit out of order? how huge is the default que etc for holding and handling these sessions? Is there a way to debug/log how often http sessions are received out-of-order ?

best regards /ti

out of order tcp packets?

Maykol Rojas — Wed, 17 Aug 2011 18:37:15 GMT

Hi,

Not a very easy way to, but you can set a capture wide open on the interface and check the out of order packets. By any chance do you have an IPS module?

Mike.

out of order tcp packets?

tiwang — Thu, 18 Aug 2011 08:06:35 GMT

hi again

yes we have SSM-20 in these boxes

out of order tcp packets?

praprama — Wed, 31 Aug 2011 19:34:42 GMT

Hi,

The ASA is actually saying there are dups of packets in out-of-order queue. packets arriving out of order for a TCP connection is pretty normal but a lot of out of order packets can affect throughput.

On the ASA, do you have inspection for http configured? What about threat-detection? If you bypass the IPs module in it, do you find the throughput satisfactory?

Regards,

Prapanch

topic out of order tcp packets? in Network Security

out of order tcp packets?

out of order tcp packets?

out of order tcp packets?

out of order tcp packets?