kernel-fxtec-pro1x/Documentation/networking
Neal Cardwell 032ee42369 tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks
Helpers for mitigating ACK loops by rate-limiting dupacks sent in
response to incoming out-of-window packets.

This patch includes:

- rate-limiting logic
- sysctl to control how often we allow dupacks to out-of-window packets
- SNMP counter for cases where we rate-limited our dupack sending

The rate-limiting logic in this patch decides to not send dupacks in
response to out-of-window segments if (a) they are SYNs or pure ACKs
and (b) the remote endpoint is sending them faster than the configured
rate limit.

We rate-limit our responses rather than blocking them entirely or
resetting the connection, because legitimate connections can rely on
dupacks in response to some out-of-window segments. For example, zero
window probes are typically sent with a sequence number that is below
the current window, and ZWPs thus expect to thus elicit a dupack in
response.

We allow dupacks in response to TCP segments with data, because these
may be spurious retransmissions for which the remote endpoint wants to
receive DSACKs. This is safe because segments with data can't
realistically be part of ACK loops, which by their nature consist of
each side sending pure/data-less ACKs to each other.

The dupack interval is controlled by a new sysctl knob,
tcp_invalid_ratelimit, given in milliseconds, in case an administrator
needs to dial this upward in the face of a high-rate DoS attack. The
name and units are chosen to be analogous to the existing analogous
knob for ICMP, icmp_ratelimit.

The default value for tcp_invalid_ratelimit is 500ms, which allows at
most one such dupack per 500ms. This is chosen to be 2x faster than
the 1-second minimum RTO interval allowed by RFC 6298 (section 2, rule
2.4). We allow the extra 2x factor because network delay variations
can cause packets sent at 1 second intervals to be compressed and
arrive much closer.

Reported-by: Avery Fay <avery@mixpanel.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-08 01:03:12 -08:00
..
caif Documentation/networking/caif: Update documentation 2012-06-25 16:44:12 -07:00
mac80211_hwsim
timestamping net-timestamp: no-payload option in txtimestamp test 2015-02-02 18:46:51 -08:00
00-INDEX Documentation/: update 00-INDEX files 2014-02-10 16:01:40 -08:00
3c509.txt drivers/net: delete all code/drivers depending on CONFIG_MCA 2012-05-17 16:37:41 -04:00
6pack.txt
alias.txt
altera_tse.txt Documentation: networking: Add Altera Ethernet (TSE) Documentation 2014-03-17 21:26:57 -04:00
arcnet-hardware.txt
arcnet.txt Documentation: Fix references to defunct linux-net@vger.kernel.org 2013-07-09 12:42:19 -07:00
atm.txt
ax25.txt
batman-adv.txt batman-adv: add missing sysfs attributes to README 2014-01-12 14:41:18 +01:00
baycom.txt Documentation: remove references to /etc/modprobe.conf 2012-03-30 16:03:15 -07:00
bonding.txt tcp: allow for bigger reordering level 2014-10-29 15:05:15 -04:00
bridge.txt bridge: update documentation references 2012-07-19 10:48:07 -07:00
can.txt Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-06-12 14:27:40 -07:00
cdc_mbim.txt net: cdc_mbim: add driver documentation 2014-05-13 17:46:09 -04:00
cops.txt
cs89x0.txt networking/cs89x0.txt: delete stale information about hand patching 2013-01-11 16:52:26 -08:00
cxacru-cf.py
cxacru.txt
cxgb.txt
dccp.txt doc: spelling error changes 2014-05-05 15:32:05 +02:00
dctcp.txt net: tcp: add DCTCP congestion control algorithm 2014-09-29 00:13:10 -04:00
de4x5.txt
decnet.txt Documentation: update broken web addresses. 2010-08-04 15:21:40 +02:00
dl2k.txt Documentation: remove references to /etc/modprobe.conf 2012-03-30 16:03:15 -07:00
dm9000.txt
dmfe.txt Documentation: networking: dmfe.txt: Remove the maintainer of orphan networking driver 2011-09-15 14:49:43 -04:00
dns_resolver.txt KEYS: Allow special keyrings to be cleared 2012-01-19 14:38:51 +11:00
driver.txt doc, net: Update ndo_start_xmit return type and values 2012-04-06 02:43:13 -04:00
e100.txt doc:net: Fix typo in Documentation/networking 2013-10-30 17:10:20 -04:00
e1000.txt Documentation/networking/: Update Intel wired LAN driver documentation 2013-08-27 16:05:26 -04:00
e1000e.txt Documentation/networking/: Update Intel wired LAN driver documentation 2013-08-27 16:05:26 -04:00
eql.txt
fib_trie.txt fib_trie.txt: fix typo 2014-12-15 11:45:15 -05:00
filter.txt net: rename vlan_tx_* helpers since "tx" is misleading there 2015-01-13 17:51:08 -05:00
fore200e.txt drivers/net: delete all code/drivers depending on CONFIG_MCA 2012-05-17 16:37:41 -04:00
framerelay.txt
gen_stats.txt
generic-hdlc.txt
generic_netlink.txt Docs/Kconfig: Update: osdl.org -> linuxfoundation.org 2010-11-15 23:50:13 +01:00
gianfar.txt gianfar: Remove sysfs stubs for FIFOCFG and stashing 2014-02-18 15:03:02 -05:00
i40e.txt i40e: adds FCoE to build and updates its documentation 2014-08-02 19:41:13 -07:00
i40evf.txt i40evf: add driver to kernel build system 2013-12-31 16:27:49 -08:00
ieee802154.txt doc:net: Fix typo in Documentation/networking 2013-10-30 17:10:20 -04:00
igb.txt igb: remove references to long gone command line parameters 2014-03-18 13:25:41 -04:00
igbvf.txt Documentation/networking/: Update Intel wired LAN driver documentation 2013-08-27 16:05:26 -04:00
ip-sysctl.txt tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks 2015-02-08 01:03:12 -08:00
ip_dynaddr.txt
ipddp.txt Documentation: update broken web addresses. 2010-08-04 15:21:40 +02:00
iphase.txt Documentation: update broken web addresses. 2010-08-04 15:21:40 +02:00
ipsec.txt xfrm: Add file to document IPsec corner case 2013-12-16 12:54:05 +01:00
ipv6.txt Documentation: remove references to /etc/modprobe.conf 2012-03-30 16:03:15 -07:00
ipvlan.txt ipvlan: Initial check-in of the IPVLAN driver. 2014-11-24 15:29:18 -05:00
ipvs-sysctl.txt ipvs: add sync_persist_mode flag 2013-06-26 18:01:46 +09:00
irda.txt
ixgb.txt Documentation/networking/: Update Intel wired LAN driver documentation 2013-08-27 16:05:26 -04:00
ixgbe.txt Documentation (ixgbe.txt): use a decimal address. 2014-12-09 16:02:32 -05:00
ixgbevf.txt Documentation/networking/: Update Intel wired LAN driver documentation 2013-08-27 16:05:26 -04:00
l2tp.txt doc:net: Fix typo in Documentation/networking 2013-10-30 17:10:20 -04:00
lapb-module.txt
LICENSE.qla3xxx
LICENSE.qlcnic qlcnic: Updating copyright information. 2013-02-04 21:08:48 -05:00
LICENSE.qlge qlge: Updating Schultz LICENSE.qlge file. 2012-02-04 15:59:30 -05:00
ltpc.txt Documentation: remove references to /etc/modprobe.conf 2012-03-30 16:03:15 -07:00
mac80211-auth-assoc-deauth.txt mac80211: set HT channel before association 2012-04-10 14:54:07 -04:00
mac80211-injection.txt mac80211: Update injection documentation 2011-10-11 16:41:16 -04:00
Makefile Documentation: use subdir-y to avoid unnecessary built-in.o files 2014-09-26 11:02:55 +02:00
multiqueue.txt
netconsole.txt netconsole: add IPv6 example in doc 2013-01-08 17:56:10 -08:00
netdev-FAQ.txt doc:net: Fix typo in Documentation/networking 2013-10-30 17:10:20 -04:00
netdev-features.txt doc/net: Fix typo in netdev-features.txt 2012-11-13 14:37:48 -05:00
netdevices.txt net: extend net_device allocation to vmalloc() 2013-11-03 23:19:00 -05:00
netif-msg.txt
netlink_mmap.txt Documentation: Update netlink_mmap.txt 2015-02-02 18:50:00 -08:00
nf_conntrack-sysctl.txt netfilter: conntrack: adjust nf_conntrack_buckets default value 2014-12-23 14:20:10 +01:00
nfc.txt NFC: add Documentation/networking/nfc.txt 2011-07-05 15:26:58 -04:00
openvswitch.txt openvswitch: Add support for unique flow IDs. 2015-01-26 15:45:50 -08:00
operstates.txt doc:net: Fix typo in Documentation/networking 2013-10-30 17:10:20 -04:00
packet_mmap.txt packet: remove deprecated syststamp timestamp 2014-07-29 11:39:50 -07:00
phonet.txt Phonet: kill the ST-Ericsson pipe controller Kconfig 2011-03-09 11:59:33 -08:00
phy.txt Documentation: networking: phy.txt: Update text for indirect MMD access 2014-07-30 20:00:22 -07:00
pktgen.txt net: pktgen: packet bursting via skb->xmit_more 2014-10-01 22:08:12 -04:00
PLIP.txt
policy-routing.txt
ppp_generic.txt ppp: Move ioctl definitions from if_ppp.h to new ppp-ioctl.h 2012-03-04 20:41:38 -05:00
proc_net_tcp.txt
radiotap-headers.txt
ray_cs.txt Documentation: update broken web addresses. 2010-08-04 15:21:40 +02:00
rds.txt
README.ipw2100 Documentation: update broken web addresses. 2010-08-04 15:21:40 +02:00
README.ipw2200 Fix common misspellings 2011-03-31 11:26:23 -03:00
README.sb1000 Documentation: update broken web addresses. 2010-08-04 15:21:40 +02:00
regulatory.txt cfg80211: consolidate passive-scan and no-ibss flags 2013-11-25 20:49:35 +01:00
rxrpc.txt af_rxrpc: Expose more RxRPC parameters via sysctls 2014-02-26 17:25:07 +00:00
s2io.txt vxge/s2io: remove dead URLs 2012-07-10 23:24:47 -07:00
scaling.txt net: Update my email address 2014-04-23 15:04:42 -04:00
sctp.txt net: sctp: trivial: update mailing list address 2013-07-24 17:53:38 -07:00
secid.txt
skfp.txt
smc9.txt
spider_net.txt doc: fix double words 2014-03-21 13:16:58 +01:00
stmmac.txt stmmac: update driver documentation 2014-11-19 15:04:57 -05:00
switchdev.txt net: introduce generic switch devices support 2014-12-02 20:01:20 -08:00
tc-actions-env-rules.txt Fix common misspellings 2011-03-31 11:26:23 -03:00
tcp-thin.txt
tcp.txt tcp: remove unused min_cwnd member of tcp_congestion_ops 2014-02-13 18:22:34 -05:00
team.txt net: introduce ethernet teaming device 2011-11-13 16:10:10 -05:00
timestamping.txt net-timestamp: no-payload option 2015-02-02 18:46:51 -08:00
tlan.txt Documentation: update broken web addresses. 2010-08-04 15:21:40 +02:00
tproxy.txt netfilter: tproxy: remove nf_tproxy_core, keep tw sk assigned to skb 2013-07-31 16:39:40 +02:00
tuntap.txt net: docs: document multiqueue tuntap API 2013-03-06 14:56:10 -05:00
udplite.txt Documentation: update broken web addresses. 2010-08-04 15:21:40 +02:00
vortex.txt doc:net: Fix typo in Documentation/networking 2013-10-30 17:10:20 -04:00
vxge.txt vxge/s2io: remove dead URLs 2012-07-10 23:24:47 -07:00
vxlan.txt vxlan: fix command usage in its doc 2012-11-23 14:03:04 -05:00
x25-iface.txt doc:net: Fix typo in Documentation/networking 2013-10-30 17:10:20 -04:00
x25.txt
xfrm_proc.txt
xfrm_sync.txt
xfrm_sysctl.txt
z8530drv.txt

sb1000 is a module network device driver for the General Instrument (also known
as NextLevel) SURFboard1000 internal cable modem board.  This is an ISA card
which is used by a number of cable TV companies to provide cable modem access.
It's a one-way downstream-only cable modem, meaning that your upstream net link
is provided by your regular phone modem.

This driver was written by Franco Venturi <fventuri@mediaone.net>.  He deserves
a great deal of thanks for this wonderful piece of code!

-----------------------------------------------------------------------------

Support for this device is now a part of the standard Linux kernel.  The
driver source code file is drivers/net/sb1000.c.  In addition to this
you will need:

1.) The "cmconfig" program.  This is a utility which supplements "ifconfig"
to configure the cable modem and network interface (usually called "cm0");
and

2.) Several PPP scripts which live in /etc/ppp to make connecting via your
cable modem easy.

   These utilities can be obtained from:

      http://www.jacksonville.net/~fventuri/

   in Franco's original source code distribution .tar.gz file.  Support for
   the sb1000 driver can be found at:

      http://web.archive.org/web/*/http://home.adelphia.net/~siglercm/sb1000.html
      http://web.archive.org/web/*/http://linuxpower.cx/~cable/

   along with these utilities.

3.) The standard isapnp tools.  These are necessary to configure your SB1000
card at boot time (or afterwards by hand) since it's a PnP card.

   If you don't have these installed as a standard part of your Linux
   distribution, you can find them at:

      http://www.roestock.demon.co.uk/isapnptools/

   or check your Linux distribution binary CD or their web site.  For help with
   isapnp, pnpdump, or /etc/isapnp.conf, go to:

      http://www.roestock.demon.co.uk/isapnptools/isapnpfaq.html

-----------------------------------------------------------------------------

To make the SB1000 card work, follow these steps:

1.) Run `make config', or `make menuconfig', or `make xconfig', whichever
you prefer, in the top kernel tree directory to set up your kernel
configuration.  Make sure to say "Y" to "Prompt for development drivers"
and to say "M" to the sb1000 driver.  Also say "Y" or "M" to all the standard
networking questions to get TCP/IP and PPP networking support.

2.) *BEFORE* you build the kernel, edit drivers/net/sb1000.c.  Make sure
to redefine the value of READ_DATA_PORT to match the I/O address used
by isapnp to access your PnP cards.  This is the value of READPORT in
/etc/isapnp.conf or given by the output of pnpdump.

3.) Build and install the kernel and modules as usual.

4.) Boot your new kernel following the usual procedures.

5.) Set up to configure the new SB1000 PnP card by capturing the output
of "pnpdump" to a file and editing this file to set the correct I/O ports,
IRQ, and DMA settings for all your PnP cards.  Make sure none of the settings
conflict with one another.  Then test this configuration by running the
"isapnp" command with your new config file as the input.  Check for
errors and fix as necessary.  (As an aside, I use I/O ports 0x110 and
0x310 and IRQ 11 for my SB1000 card and these work well for me.  YMMV.)
Then save the finished config file as /etc/isapnp.conf for proper configuration
on subsequent reboots.

6.) Download the original file sb1000-1.1.2.tar.gz from Franco's site or one of
the others referenced above.  As root, unpack it into a temporary directory and
do a `make cmconfig' and then `install -c cmconfig /usr/local/sbin'.  Don't do
`make install' because it expects to find all the utilities built and ready for
installation, not just cmconfig.

7.) As root, copy all the files under the ppp/ subdirectory in Franco's
tar file into /etc/ppp, being careful not to overwrite any files that are
already in there.  Then modify ppp@gi-on to set the correct login name,
phone number, and frequency for the cable modem.  Also edit pap-secrets
to specify your login name and password and any site-specific information
you need.

8.) Be sure to modify /etc/ppp/firewall to use ipchains instead of
the older ipfwadm commands from the 2.0.x kernels.  There's a neat utility to
convert ipfwadm commands to ipchains commands:

   http://users.dhp.com/~whisper/ipfwadm2ipchains/

You may also wish to modify the firewall script to implement a different
firewalling scheme.

9.) Start the PPP connection via the script /etc/ppp/ppp@gi-on.  You must be
root to do this.  It's better to use a utility like sudo to execute
frequently used commands like this with root permissions if possible.  If you
connect successfully the cable modem interface will come up and you'll see a
driver message like this at the console:

         cm0: sb1000 at (0x110,0x310), csn 1, S/N 0x2a0d16d8, IRQ 11.
         sb1000.c:v1.1.2 6/01/98 (fventuri@mediaone.net)

The "ifconfig" command should show two new interfaces, ppp0 and cm0.
The command "cmconfig cm0" will give you information about the cable modem
interface.

10.) Try pinging a site via `ping -c 5 www.yahoo.com', for example.  You should
see packets received.

11.) If you can't get site names (like www.yahoo.com) to resolve into
IP addresses (like 204.71.200.67), be sure your /etc/resolv.conf file
has no syntax errors and has the right nameserver IP addresses in it.
If this doesn't help, try something like `ping -c 5 204.71.200.67' to
see if the networking is running but the DNS resolution is where the
problem lies.

12.) If you still have problems, go to the support web sites mentioned above
and read the information and documentation there.

-----------------------------------------------------------------------------

Common problems:

1.) Packets go out on the ppp0 interface but don't come back on the cm0
interface.  It looks like I'm connected but I can't even ping any
numerical IP addresses.  (This happens predominantly on Debian systems due
to a default boot-time configuration script.)

Solution -- As root `echo 0 > /proc/sys/net/ipv4/conf/cm0/rp_filter' so it
can share the same IP address as the ppp0 interface.  Note that this
command should probably be added to the /etc/ppp/cablemodem script
*right*between* the "/sbin/ifconfig" and "/sbin/cmconfig" commands.
You may need to do this to /proc/sys/net/ipv4/conf/ppp0/rp_filter as well.
If you do this to /proc/sys/net/ipv4/conf/default/rp_filter on each reboot
(in rc.local or some such) then any interfaces can share the same IP
addresses.

2.) I get "unresolved symbol" error messages on executing `insmod sb1000.o'.

Solution -- You probably have a non-matching kernel source tree and
/usr/include/linux and /usr/include/asm header files.  Make sure you
install the correct versions of the header files in these two directories.
Then rebuild and reinstall the kernel.

3.) When isapnp runs it reports an error, and my SB1000 card isn't working.

Solution -- There's a problem with later versions of isapnp using the "(CHECK)"
option in the lines that allocate the two I/O addresses for the SB1000 card.
This first popped up on RH 6.0.  Delete "(CHECK)" for the SB1000 I/O addresses.
Make sure they don't conflict with any other pieces of hardware first!  Then
rerun isapnp and go from there.

4.) I can't execute the /etc/ppp/ppp@gi-on file.

Solution -- As root do `chmod ug+x /etc/ppp/ppp@gi-on'.

5.) The firewall script isn't working (with 2.2.x and higher kernels).

Solution -- Use the ipfwadm2ipchains script referenced above to convert the
/etc/ppp/firewall script from the deprecated ipfwadm commands to ipchains.

6.) I'm getting *tons* of firewall deny messages in the /var/kern.log,
/var/messages, and/or /var/syslog files, and they're filling up my /var
partition!!!

Solution -- First, tell your ISP that you're receiving DoS (Denial of Service)
and/or portscanning (UDP connection attempts) attacks!  Look over the deny
messages to figure out what the attack is and where it's coming from.  Next,
edit /etc/ppp/cablemodem and make sure the ",nobroadcast" option is turned on
to the "cmconfig" command (uncomment that line).  If you're not receiving these
denied packets on your broadcast interface (IP address xxx.yyy.zzz.255
typically), then someone is attacking your machine in particular.  Be careful
out there....

7.) Everything seems to work fine but my computer locks up after a while
(and typically during a lengthy download through the cable modem)!

Solution -- You may need to add a short delay in the driver to 'slow down' the
SURFboard because your PC might not be able to keep up with the transfer rate
of the SB1000. To do this, it's probably best to download Franco's
sb1000-1.1.2.tar.gz archive and build and install sb1000.o manually.  You'll
want to edit the 'Makefile' and look for the 'SB1000_DELAY'
define.  Uncomment those 'CFLAGS' lines (and comment out the default ones)
and try setting the delay to something like 60 microseconds with:
'-DSB1000_DELAY=60'.  Then do `make' and as root `make install' and try
it out.  If it still doesn't work or you like playing with the driver, you may
try other numbers.  Remember though that the higher the delay, the slower the
driver (which slows down the rest of the PC too when it is actively
used). Thanks to Ed Daiga for this tip!

-----------------------------------------------------------------------------

Credits:  This README came from Franco Venturi's original README file which is
still supplied with his driver .tar.gz archive.  I and all other sb1000 users
owe Franco a tremendous "Thank you!"  Additional thanks goes to Carl Patten
and Ralph Bonnell who are now managing the Linux SB1000 web site, and to
the SB1000 users who reported and helped debug the common problems listed
above.


					Clemmitt Sigler
					csigler@vt.edu