From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-yh0-x22c.google.com (mail-yh0-x22c.google.com [IPv6:2607:f8b0:4002:c01::22c]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by huchra.bufferbloat.net (Postfix) with ESMTPS id 93B5621F21F for ; Thu, 3 Apr 2014 03:09:50 -0700 (PDT) Received: by mail-yh0-f44.google.com with SMTP id f10so1427980yha.17 for ; Thu, 03 Apr 2014 03:09:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=Y3mzymQZUjaYHHRzlRhITID+SNLgVDEMMi9p1AXxiZc=; b=HLofgWBwErGF/DfVT0pIdUIGTW4dh7KIEliM1TmEkqZMglSoKqEXX6jTvT2rV7WJxc sSO+0niNOQ3B8EXf51s+TaRVja1Jnevx5MV1ZDv80sfAbRpgRTFcOrrc0jKP2ZAw7FxX WVGZPsx9FWkdwtro82mrVtYsbp7lLmJUE9p0fTRJy2ZzJkcySZvavk+WiRL7r1GmGi+J gIf25CVIXN14jVG0ODKAg5RO/C4UmjW54dzhyQ03BW6zocXUuxmJ/K0V4N2V2vcaA1rJ 5ssRVCC9R2WZnfVvhEJiBUlca45JbvCzx+ECbzGhuB6wPZZWEjvYaSb0vaOCXcZp25rH sAAg== X-Received: by 10.236.206.7 with SMTP id k7mr7571812yho.84.1396519789206; Thu, 03 Apr 2014 03:09:49 -0700 (PDT) MIME-Version: 1.0 Received: by 10.170.71.133 with HTTP; Thu, 3 Apr 2014 03:09:29 -0700 (PDT) In-Reply-To: References: From: David Personette Date: Thu, 3 Apr 2014 06:09:29 -0400 Message-ID: To: Dave Taht Content-Type: multipart/alternative; boundary=089e01160d0ef522a104f62099db Cc: "cerowrt-devel@lists.bufferbloat.net" Subject: Re: [Cerowrt-devel] cerowrt-3.10.34-4 dev build released X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Apr 2014 10:09:50 -0000 --089e01160d0ef522a104f62099db Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable http://arstechnica.com/security/2014/04/how-new-malware-is-making-the-inter= net-of-things-the-windows-xp-of-2014/ It's reaching tech journalism now. Could it be an attempted exploit taking out jg's router? IE, another hacked router on his cable modem segment scanning for other hosts to exploit. --=20 David P. On Wed, Apr 2, 2014 at 10:43 PM, Dave Taht wrote: > I am actually far from convinced it is actually a wifi bug. It could > be something going wrong with routing, firewalling, nat, or something > else entirely. I have several captures of sw00 and ge00 taken after > the event occurs, and local udp, arp, and icmp and icmpv6 traffic is > working correctly. As is multicast. > > The other device (sw10) stays running... > > What I see in the captures I have is syn attempts from the sw00 > interface do make it to the internet, and syn/ack attempts do return > through ge00, but > do not make it through sw00. However I don't see ANY local syn > attempts in the capture I have: jg or someone needs to try a local tcp > connection to a local device or through the local router to a local > ethernet device after having it hang... (I will keep trying to > reproduce here) > > tcp.flags =3D=3D 0x0002 > > On Wed, Apr 2, 2014 at 6:48 PM, Stephen Hemminger > wrote: > > I am seeing wireless hang as well. > > Mostly when multiple macbooks are active on 2.4g > > > > -- > Dave T=C3=A4ht > > Fixing bufferbloat with cerowrt: > http://www.teklibre.com/cerowrt/subscribe.html > _______________________________________________ > Cerowrt-devel mailing list > Cerowrt-devel@lists.bufferbloat.net > https://lists.bufferbloat.net/listinfo/cerowrt-devel > --089e01160d0ef522a104f62099db Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
http://a= rstechnica.com/security/2014/04/how-new-malware-is-making-the-internet-of-t= hings-the-windows-xp-of-2014/

It's re= aching tech journalism now. Could it be an attempted exploit taking out jg&= #39;s router? IE, another hacked router on his cable modem segment scanning= for other hosts to exploit.

--
David P.

On Wed, Apr 2, 2014 at 10:43 PM, Dave Ta= ht <dave.taht@gmail.com> wrote:
I am actually far from convinced it is actually a wifi bug. It could
be something going wrong with routing, firewalling, nat, or something
else entirely. I have several captures of sw00 and ge00 taken after
the event occurs, and local udp, arp, and icmp and icmpv6 traffic is
working correctly. As is multicast.

The other device (sw10) stays running...

What I see in the captures I have is syn attempts from the sw00
interface do make it to the internet, and syn/ack attempts do return
through ge00, but
do not =C2=A0make it through sw00. However I don't see ANY local syn attempts in the capture I have: jg or someone needs to try a local tcp
connection to a local device or through the local router to a local
ethernet device after having it hang... (I will keep trying to
reproduce here)

tcp.flags =3D=3D 0x0002

On Wed, Apr 2, 2014 at 6:48 PM, Stephen Hemminger
<stephen@networkplumber.or= g> wrote:
> I am seeing wireless han= g as well.
> Mostly when multiple macbooks are active on 2.4g



--
Dave T=C3=A4ht

Fixing bufferbloat with cerowrt: http://www.teklibre.com/cerowrt/subscrib= e.html
_______________________________________________
Cerowrt-devel mailing list
Cerowrt-devel@lists.= bufferbloat.net
https://lists.bufferbloat.net/listinfo/cerowrt-devel

--089e01160d0ef522a104f62099db--