Linux Mint 13 : can’t connect to only secure sites ( https )

mint-13 ~ # uname -a Linux mint-13 3.2.0-31-generic #50-Ubuntu SMP Fri Sep 7 16:16:45 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux mint-13 ~ # tail -1 /etc/lsb-release DISTRIB_DESCRIPTION="Linux Mint 13 Maya"

When I access to secure sites (https) , the load time of secure sites is very slow , I’ve faced timed out.
the load time of non secure sites are Okay , I can access to http site without stress.

why ??

Here’s a capture data when accessing to a secure site.
scaling factor is ..-1 ??? and window size is small..

mint-13 ~ # tshark -i eth0 port 443 -V | grep -i window tshark: Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled Running as user "root" and group "root". This could be dangerous. Capturing on eth0        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 942    [Calculated window size: 942]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 306    [Calculated window size: 306]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 331    [Calculated window size: 331]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set

window scaling is enabled by default

mint-13 ~ # cat /proc/sys/net/ipv4/tcp_window_scaling 1

disable window scale to try.

mint-13 ~ # echo 0 > /proc/sys/net/ipv4/tcp_window_scaling mint-13 ~ # cat /proc/sys/net/ipv4/tcp_window_scaling 0

access to the secure site again.
I could access to the secure site without stress.

Here’s capture data.
scaling factor is still -1 , however window size seems to become normal.

mint-13 ~ # tshark -i eth0 port 443 -V | grep -i window tshark: Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled Running as user "root" and group "root". This could be dangerous. Capturing on eth0        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 41850    [Calculated window size: 41850]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 41850    [Calculated window size: 41850]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 62851    [Calculated window size: 62851]    [Window size scaling factor: -1 (unknown)]        .... 0... .... = Congestion Window Reduced (CWR): Not set    Window size value: 41850    [Calculated window size: 41850]

wired behavior.

tshark version

mint-13 ~ # tshark -v | head -1 tshark: Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled TShark 1.6.7

turn off window scaling permanently

mint-13 ~ # tail -1 /etc/sysctl.conf net.ipv4.tcp_window_scaling = 0

the value of scaling factor "-1" seems to be tshark’s issue..

when enabling window scale.

mint-13 ~ # tshark -i eth0 port 443 | grep -i syn tshark: Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled Running as user "root" and group "root". This could be dangerous. Capturing on eth0  4.818885 192.168.11.100 -> 74.125.235.111 TCP 74 49827 > https [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=552473 TSecr=0 WS=128  4.823766 74.125.235.111 -> 192.168.11.100 TCP 74 https > 49827 [SYN, ACK] Seq=0 Ack=1 Win=14180 Len=0 MSS=1430 SACK_PERM=1 TSval=21743779 TSecr=552473 WS=64

when disabling window scale. there’s no scaling option in the TCP header.

mint-13 ~ # tshark -i eth0 port 443 | grep -i syn tshark: Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled Running as user "root" and group "root". This could be dangerous. Capturing on eth0  1.545670 192.168.11.100 -> 74.125.235.113 TCP 70 59065 > https [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=543894 TSecr=0  1.555951 74.125.235.113 -> 192.168.11.100 TCP 70 https > 59065 [SYN, ACK] Seq=0 Ack=1 Win=14180 Len=0 MSS=1430 SACK_PERM=1 TSval=21139320 TSecr=543894

Linux : TCP Window scaling

How to check whether or not your OS supports TCP Window scaling.

# cat /proc/sys/net/ipv4/tcp_window_scaling 1

1 : enable window scale

0 : disable window scale

[ when disabling TCP window scale ]

Client ( CentOS 6.2 ) ------ web sites

OS informs Window scaling factor when sending syn packet.

# echo 0 > /proc/sys/net/ipv4/tcp_window_scaling

capture and then access to an web site.

# tshark -i eth0 port 80 -w ws_disable.pcap

# wget http://www.google.com

Here’s a syn packet sent from the client

Client -> google

the client does not add window scale option in TCP options.

Flags: 0x02 (SYN)        0... .... = Congestion Window Reduced (CWR): Not set        .0.. .... = ECN-Echo: Not set        ..0. .... = Urgent: Not set        ...0 .... = Acknowledgement: Not set        .... 0... = Push: Not set        .... .0.. = Reset: Not set        .... ..1. = Syn: Set    Options: (16 bytes)        Maximum segment size: 1460 bytes        SACK permitted

[ when enabling Window scale ]

enable window scale

# echo 1 > /proc/sys/net/ipv4/tcp_window_scaling

# tshark -i eth0 port 80 -w ws_enable.pcap # wget http://www.google.com

syn packet

The client adds window scaling factor in TCP options.

Flags: 0x02 (SYN)        0... .... = Congestion Window Reduced (CWR): Not set        .0.. .... = ECN-Echo: Not set        ..0. .... = Urgent: Not set        ...0 .... = Acknowledgement: Not set        .... 0... = Push: Not set        .... .0.. = Reset: Not set        .... ..1. = Syn: Set    Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 807482, TSecr 0        NOP        Window scale: 6 (multiply by 64)  <-  2**6  =64

In this case , Window size will be 1460 * 2**6 = 93440

[ how to change window scaling factor ]

You may change scaling factor by editing the following three files. ( receive buffer )

/proc/sys/net/ipv4/tcp_rmem

/proc/sys/net/core/rmem_default

/proc/sys/net/core/rmem_max

The scaling factor range is from 0 to 14.

- scaling factor : 0

# echo "4096 65535 65535" > /proc/sys/net/ipv4/tcp_rmem # echo 65535 > /proc/sys/net/core/rmem_default # echo 65535 > /proc/sys/net/core/rmem_max

Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 1516864, TSecr 0        NOP        Window scale: 0 (multiply by 1)

window size : 1460 * 2**0 = 1460

- scaling factor : 1

# echo 131070 > /proc/sys/net/core/rmem_max # echo 131070 > /proc/sys/net/core/rmem_default # echo "4096 131070 131070" > /proc/sys/net/ipv4/tcp_rmem

Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 1665986, TSecr 0        NOP        Window scale: 1 (multiply by 2)

window size : 1460 * 2**1 = 2920

- scaling factor : 2

# echo "4096 196605 196605" > /proc/sys/net/ipv4/tcp_rmem # echo 196605 > /proc/sys/net/core/rmem_default # echo 196605 > /proc/sys/net/core/rmem_max

Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 1892175, TSecr 0        NOP        Window scale: 2 (multiply by 4)

- scaling factor : 3

# echo "4096 300000 300000" > /proc/sys/net/core/rmem_default # echo 300000 > /proc/sys/net/core/rmem_max # echo 300000 > /proc/sys/net/core/rmem_default

Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 3386446, TSecr 0        NOP        Window scale: 3 (multiply by 8)

- scaling factor : 4

# echo 1048560 > /proc/sys/net/core/rmem_default # echo 1048560 > /proc/sys/net/core/rmem_max # echo "4096 1048560 1048560" > /proc/sys/net/ipv4/tcp_rmem

Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 3644467, TSecr 0        NOP        Window scale: 4 (multiply by 16)

- scaling factor : 5

>>> 65535*2**5

2097120

scaling factor becomes 5 ???

# echo 2097120 > /proc/sys/net/core/rmem_default # echo 2097120 > /proc/sys/net/core/rmem_max # echo "4096 2097120 2097120" > /proc/sys/net/ipv4/tcp_rmem

Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 3817108, TSecr 0        NOP        Window scale: 5 (multiply by 32)

- scaling factor : 6

>>> 65535*2**6

4194240

# echo 4194240 > /proc/sys/net/core/rmem_default # echo 4194240 > /proc/sys/net/core/rmem_max # echo "4096 4194240 4194240" > /proc/sys/net/ipv4/tcp_rmem

Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 4000584, TSecr 0        NOP        Window scale: 6 (multiply by 64)

- scaling factor : 7

>>> 65535*2**7

8388480

# echo 8388480 > /proc/sys/net/core/rmem_default # echo 8388480 > /proc/sys/net/core/rmem_max # echo "4096 8388480 8388480" > /proc/sys/net/ipv4/tcp_rmem

Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 4338817, TSecr 0        NOP        Window scale: 7 (multiply by 128)

- scaling factor : 8

>>> 65535*2**8

16776960

# echo "4096 16776960 16776960" > /proc/sys/net/ipv4/tcp_rmem # echo 16776960 > /proc/sys/net/core/rmem_default # echo 16776960 > /proc/sys/net/core/rmem_max

Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 4465434, TSecr 0        NOP        Window scale: 8 (multiply by 256)

- scaling factor : 9

>>> 65535*2**9

33553920

# echo 33553920 > /proc/sys/net/core/rmem_default # echo 33553920 > /proc/sys/net/core/rmem_max # echo "4096 33553920 33553920" > /proc/sys/net/ipv4/tcp_rmem

Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 4596689, TSecr 0        NOP        Window scale: 9 (multiply by 512)

scale factor 10 – 14 ….. I’m tired of checking … :(