Re: Fw: oops/bug in tcp, SACK doesn't work?

[kuznet@xxxxxxxxxxxxx]

Hello!

> Please note that the netfilter nat protocol helpers for ftp (and irc as well 
> as
> other protocols in patch-o-matic) delete the SACKPERM option on-the-fly 
> from all packets.

Then Marty would not see any sacks at all.


> It has to, as you run in neverending complications as soon as the nat helper
> has to alter the tcp sequence numbers, etc.

It is not a valid justification. It is difficult to rewrite sequence numbers.
As soon as nat does this, rewriting sacks is easy. Even not easy, trivial.

Sad and not expected behaviour. I used to ridicule commercial firewall vendors,
sometimes doing shit of this kind without any clear reasons. :-)

Alexey