It turns out that our router was injecting the RST packets because Netfilter declared the packet invalid. There is a setting that makes netfitler more liberal so I tried enabling it (inet.ipv4.netfilter.ip_conntrack_tcp_be_liberal=1) and the connection is no longer torn down.
However, I still haven't figured out why netfilter declared that packet as invalid. Enabling "ip_conntrack_log_invalid" doesn't cause anything to be printed in the log.
This is a guess. Maybe running some traceroutes to the target target and collecting the hops. Then pinging each of the hops with a 1500 byte packet configured for a 100 count would help identify problems links.
The sender is entitled to send any length packet it likes between 1 and 1460 (in this case, being your apparent MTU). The question is why does your server send the RST?
发布评论
评论（3）
所以我们终于弄清楚了——
事实证明，我们的路由器正在注入 RST 数据包，因为 Netfilter 声明该数据包无效。有一个设置使 netfitler 更加自由，因此我尝试启用它（inet.ipv4.netfilter.ip_conntrack_tcp_be_liberal=1）并且连接不再被断开。
但是，我仍然不明白为什么 netfilter 声明该数据包无效。启用“ip_conntrack_log_invalid”不会导致在日志中打印任何内容。
So we finally figured it out-
It turns out that our router was injecting the RST packets because Netfilter declared the packet invalid. There is a setting that makes netfitler more liberal so I tried enabling it (inet.ipv4.netfilter.ip_conntrack_tcp_be_liberal=1) and the connection is no longer torn down.
However, I still haven't figured out why netfilter declared that packet as invalid. Enabling "ip_conntrack_log_invalid" doesn't cause anything to be printed in the log.
这是一个猜测。也许运行一些到目标目标的跟踪路由并收集跳数。然后使用配置为 100 计数的 1500 字节数据包对每个跃点进行 ping 操作将有助于识别问题链路。
This is a guess. Maybe running some traceroutes to the target target and collecting the hops. Then pinging each of the hops with a 1500 byte packet configured for a 100 count would help identify problems links.
发送方有权发送 1 到 1460 之间的任何长度的数据包（在本例中，即您的表观 MTU）。问题是你的服务器为什么发送RST？
The sender is entitled to send any length packet it likes between 1 and 1460 (in this case, being your apparent MTU). The question is why does your server send the RST?