Subject: TCP SYN+ACK w/MSS of 0

From: "B. James Phillippe" <[email-masked]>
Date: Mon, 27 Aug 2001 17:21:38 -0700 (PDT)

Greetings,

I have found a few sites on the Net which seem to respond to a SYN with a
SYN+ACK that has an MSS value of 0.  This is breaking the TCP on one of my
client systems.  I am having trouble finding a definitive answer as to
whether an MSS of 0 is valid, and (whether it is or not) how to handle it.
Would it be correct to treat an MSS of 0 as the default 536?

Any advice?

Here is a snapshot of the 3WHS:

17:25:12.290438 P myclient.49282 > 63.88.172.166.www: S 2568369694:2568369694(0) win 512 <mss 1460>
17:25:12.330259 P 63.88.172.166.www > myclient.49282: S 430790624:430790624(0) ack 2568369695 win 8576 <mss 0> (DF)
17:25:12.330887 P myclient.49282 > 63.88.172.166.www: . 1:1(0) ack 1 win 32120 (DF)
17:25:12.332742 P myclient.49282 > 63.88.172.166.www: F 1:1(0) ack 1 win 32767
17:25:12.376627 P 63.88.172.166.www > myclient.49282: . 1:1(0) ack 2 win 8576 (DF)
17:25:12.376831 P 63.88.172.166.www > myclient.49282: F 1:1(0) ack 2 win 8576 (DF)
17:25:12.377280 P myclient.49282 > 63.88.172.166.www: . 2:2(0) ack 2 win 32766 (DF)

thanks,
-bp
--
# bryan at terran dot org
# http://www.terran.org/~bryan

---

From: Alan Cox <[email-masked]>
Date: Tue, 28 Aug 2001 01:46:27 +0100 (BST)

> Would it be correct to treat an MSS of 0 as the default 536?

Well an MSS of 0 is not meaningfully sane. It basically says "speak in 0
length chunks".

> Any advice?

I'd be inclined to treat it as if the MSS value was not there, and possibly
to log it (rate limited of course) since it might indicate other problems to
come.

I guess that is being liberal in what you accept. I just wish customers
wouldnt apply the same rule to the code quality they accept they will 
pay for 8)

Alan

---

From: Tom Lane <[email-masked]>
Date: Mon, 27 Aug 2001 21:41:09 -0400

> Well an MSS of 0 is not meaningfully sane. It basically says "speak in 0

Is it possible that these sites don't *want* to talk to you?

Small MSS is a pretty standard setup for a teergrube (port-scan
honeypot).  Setting it to 0 would not be something I'd do, since it'd
make the intention too obvious, but maybe these are overly-aggressively-
configured teergrubes.

			regards, tom lane