WAAS sends malformed tcp options to server

[Christopher Isett]

I have a WAAS running 4.4.3.b. When I look at a wireshark trace taken between the server and the WAAS wirshark says I have malformed TCP options coming from the WAAS. There are many NOOP options padded on the end of the options list. There also is no End of Options List.

This seems to me to be a bug.

I also have noticed that sometimes the WAAS sends an MSS of 1260 and a WS of 4. Othertimes it sends an MSS of 1460 and a WS of 256. Again this seems inconsistant.

My packet capture is directly behind the WAAS. No firewalls or anything like that messing with the options field. Below is what it looks like in Wireshark.

                  

[Nicolas Fournier]

Hi Christopher,

Do you use WCCP or Inline interfaces?

In both cases, I would take a capture directly on the WAE with the tethereal command to see the packet before and after it is handled by the WAE.

Something like this should get you what you are looknig for:

tethereal -s 1600 -w optionscap -i  -f "host 10.107.160.238 and host 64.46.224.78"

If you use inline, you'll need to set this up from two CLI, one for the WAN side and one for the LAN side.

This should show you exactly the changes WAAS is doing to your TCP options as we can then compare the SYN before and after it is handled.

Regards,

Nicolas