scroot / gopacket

Automatically exported from code.google.com/p/gopacket
BSD 3-Clause "New" or "Revised" License
0 stars 1 forks source link

Reusing old connection for new connection #57

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Start assembler while connections are running.
2. Wait for given duration
3. Run FlushOlderThan(now-duration)
4. Begin new connection matching signature of a connection that was established 
before start

What is the expected output? What do you see instead?
Existing connection closed at flush, new connection tracked correctly

What version of the product are you using? On what operating system?
master branch at 35960c88f08138235636f33b18236050c9bdbffe
linux

Please provide any additional information below.

debug log:
2015/01/08 11:58:13 [10.3.1.100->172.17.0.24 39530->6379] waiting for start, 
storing into connection
2015/01/08 11:58:13 [10.3.1.100->172.17.0.24 39530->6379] waiting for start, 
storing into connection
....
2015/01/08 12:45:36 [10.3.1.100->172.17.0.24 39530->6379] saw first SYN packet, 
returning immediately, seq=3035267911
2015/01/08 12:45:36 [10.3.1.100->172.17.0.24 39530->6379]   adding from conn 
(397240757, 3035267912)
2015/01/08 12:45:36 [10.3.1.100->172.17.0.24 39530->6379]   adding from conn 
(397240761, 3035267912)
2015/01/08 12:45:36 [10.3.1.100->172.17.0.24 39530->6379] closing
2015/01/08 12:45:36 [10.3.1.100->172.17.0.24 39530->6379] waiting for start, 
storing into connection
2015/01/08 12:45:36 [10.3.1.100->172.17.0.24 39530->6379] waiting for start, 
storing into connection
2015/01/08 12:45:36 [10.3.1.100->172.17.0.24 39530->6379] waiting for start, 
storing into connection
...

As you can see, it's quite weird, the new connection starts almost an hour 
after the first packets are seen for that port number (enough time for the port 
number to wrap around and get reused)

It seems to never close the old connection because I don't think it ever saw it 
start, then when it does see it start (albeit a completely new connection) it's 
like "Ahha! I can close it now because I've seen it start".

Perfect logic, but the connection it saw open is a different connection to the 
one it saw close almost an hour previous.

Original issue reported on code.google.com by norga...@gmail.com on 8 Jan 2015 at 1:50

GoogleCodeExporter commented 9 years ago
Could you grab me another debug log, and annotate in it when you called 
FlushOlderThan and what timestamp you passed into it?

Original comment by gconnell@google.com on 8 Jan 2015 at 11:42

GoogleCodeExporter commented 9 years ago
I was calling FlushOlderThan(time.Now().Add(-2 * time.Minute)) every 5 seconds 
for the entire 47 minutes between 11:58 and 12:45

Original comment by norga...@gmail.com on 9 Jan 2015 at 4:15