--On Wednesday, January 08, 2003 19:05:36 +0100 Fabio Massimo Di Nitto
I was able to reproduce the problem again. I have been using ethereal to
sniff instead of tcpdump and gave out some more info.
basically the icecast server at certain time (but i can't predict
exactly in which situations) just send a FIN, ACK packet to the client.
Basically to close the connection and after a few packets the client of
course answer.What is strange that in the meanwhile there are still 3/4
data packets coming from the server to the client.
Regarding the network side I noticed the following:
an average of 500ms to ping6 the server and 0 pkt loss
few seconds before the FIN, ACK (server->client) and for about 6 pkts the
average jumped to 2000ms
I suspect that this network flap made the server thinking about
<insert_here_whatever_term_is_more_appropriate> and decided to close
Probably on the server's side it got an ICMP Host Unreachable or two as
some router updated its tables, and decided to close the connection. The
FIN jumped the queue in one/several of the routers in the path, so it got
reordered relative to the data. This would imply that the router in
question had its route to you back by the time the FIN got there.
Wierd, but far from impossible.
The full ethereal dump is available at
but PLEASE note that it is a 10MB file and Im on a slow adsl line so be
I think you provided enough info to tell what happened.
PS Im afraid/happy that anyway the problem is not related to the kernel
version we are running.
Doesn't look like a kernel problem.
Someone's got a dodgy link or a routing problem.