From: Luan Nguyen (luan@netcraftsmen.net)
Date: Mon Nov 17 2008 - 17:07:43 ARST
Are you absolutely sure the connection is idle? :)
Anyhow, what does "show tcp intercept conn" show?
Mine always terminate "on-time"
Regards,
Luan Nguyen
Chesapeake NetCraftsmen, LLC.
www.NetCraftsmen.net
(aim/yahoo/gtalk): luancnc
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of Huan
Pham
Sent: Monday, November 17, 2008 12:37 AM
To: Cisco certification
Subject: TCP Intercept connection-timeout timer
Hi,
I am playing with TCP Connection-timeout timer. Topo is as below.
R1 ------------ R4 --------------- BB1
155.1.146.1 204.12.1.254
R4 does TCP intercept. I am trying to verify the effect of the command
"ip tcp intercept connection-timeout"
I am testing TCP intercept connection timeout timer, by telnet from R1
to BB1 and let that connection idle (i.e. I do not type anything once I
sucessfully telnet to BB1). R4 should disconnect this idle TCP session
within a configurable "connection-timeout" period. But what I see is
that it always terminates TCP idle sessions 1 minutes later that it
should. For instance, if I configure the connection-timout timer as 1
minute, then idle TCP sessions are terminated after 2 minutes of no
activity !
Where does that additional 1 minute come from? Any idea please? Many
thanks.
Regards,
Rack1R1#telnet 204.12.1.254
Trying 204.12.1.254 ... Open
BB3>
Rack1R4#sh run | in tcp
ip tcp synwait-time 300
ip tcp intercept list 199
ip tcp intercept connection-timeout 60
access-list 199 permit tcp any host 204.12.1.254
Rack1R4#
*Apr 7 23:12:55.134: INTERCEPT: new connection (155.1.146.1:52825 SYN
-> 204.12.1.254:23)
*Apr 7 23:12:55.134: INTERCEPT(*): (155.1.146.1:52825 <- ACK+SYN
204.12.1.254:23)
*Apr 7 23:12:55.134: INTERCEPT: 1st half of connection is established
(155.1.146.1:52825 ACK -> 204.12.1.254:23)
*Apr 7 23:12:55.138: INTERCEPT(*): (155.1.146.1:52825 SYN ->
204.12.1.254:23)
*Apr 7 23:12:55.158: INTERCEPT: 2nd half of connection established
(155.1.146.1:52825 <- ACK+SYN 204.12.1.254:23)
*Apr 7 23:12:55.158: INTERCEPT(*): (155.1.146.1:52825 ACK ->
204.12.1.254:23)
*Apr 7 23:12:55.158: INTERCEPT(*): (155.1.146.1:52825 <- WINDOW
204.12.1.254:23)
*Apr 7 23:14:55.166: INTERCEPT: ESTAB timing out (155.1.146.1:52825 <->
204.12.1.254:23)
*Apr 7 23:14:55.166: INTERCEPT(*): (155.1.146.1:52825 <- RST
204.12.1.254:23)
*Apr 7 23:14:55.166: INTERCEPT(*): (155.1.146.1:52825 RST ->
204.12.1.254:23)
Rack1R4#c
Enter configuration commands, one per line. End with CNTL/Z.
Rack1R4(config)#ip tcp intercept connection-timeout 120
command accepted, interfaces with mls configured might cause
inconsistent behavior
Rack1R4#
*Apr 7 23:21:52.006: INTERCEPT: new connection (155.1.146.1:29099 SYN
-> 204.12.1.254:23)
*Apr 7 23:21:52.010: INTERCEPT(*): (155.1.146.1:29099 <- ACK+SYN
204.12.1.254:23)
*Apr 7 23:21:52.010: INTERCEPT: 1st half of connection is established
(155.1.146.1:29099 ACK -> 204.12.1.254:23)
*Apr 7 23:21:52.010: INTERCEPT(*): (155.1.146.1:29099 SYN ->
204.12.1.254:23)
*Apr 7 23:21:52.034: INTERCEPT: 2nd half of connection established
(155.1.146.1:29099 <- ACK+SYN 204.12.1.254:23)
*Apr 7 23:21:52.034: INTERCEPT(*): (155.1.146.1:29099 ACK ->
204.12.1.254:23)
*Apr 7 23:21:52.034: INTERCEPT(*): (155.1.146.1:29099 <- WINDOW
204.12.1.254:23)
*Apr 7 23:24:52.042: INTERCEPT: ESTAB timing out (155.1.146.1:29099 <->
204.12.1.254:23)
*Apr 7 23:24:52.042: INTERCEPT(*): (155.1.146.1:29099 <- RST
204.12.1.254:23)
*Apr 7 23:24:52.042: INTERCEPT(*): (155.1.146.1:29099 RST ->
204.12.1.254:23)
Rack1R4#c
Enter configuration commands, one per line. End with CNTL/Z.
Rack1R4(config)#ip tcp intercept connection-timeout 150
command accepted, interfaces with mls configured might cause
inconsistent behavior
Rack1R4#
*Apr 7 23:26:25.934: INTERCEPT: new connection (155.1.146.1:19604 SYN
-> 204.12.1.254:23)
*Apr 7 23:26:25.934: INTERCEPT(*): (155.1.146.1:19604 <- ACK+SYN
204.12.1.254:23)
*Apr 7 23:26:25.934: INTERCEPT: 1st half of connection is established
(155.1.146.1:19604 ACK -> 204.12.1.254:23)
*Apr 7 23:26:25.938: INTERCEPT(*): (155.1.146.1:19604 SYN ->
204.12.1.254:23)
*Apr 7 23:26:25.958: INTERCEPT: 2nd half of connection established
(155.1.146.1:19604 <- ACK+SYN 204.12.1.254:23)
*Apr 7 23:26:25.958: INTERCEPT(*): (155.1.146.1:19604 ACK ->
204.12.1.254:23)
*Apr 7 23:26:25.958: INTERCEPT(*): (155.1.146.1:19604 <- WINDOW
204.12.1.254:23)
*Apr 7 23:29:55.970: INTERCEPT: ESTAB timing out (155.1.146.1:19604 <->
204.12.1.254:23)
*Apr 7 23:29:55.970: INTERCEPT(*): (155.1.146.1:19604 <- RST
204.12.1.254:23)
*Apr 7 23:29:55.970: INTERCEPT(*): (155.1.146.1:19604 RST ->
204.12.1.254:23)
Blogs and organic groups at http://www.ccie.net
This archive was generated by hypermail 2.1.4 : Mon Dec 01 2008 - 08:18:30 ARST