A blind reset into a connection in hardware, judged by pf again, measured, 2026-10-24
Issue 679, the part still open: a FIN or a
RST of a connection in hardware. The fast path hands every one to the host
(TO_KN_TCP_FIN_SYN_RST), and pf's state for a connection in hardware is sloppy - it no longer sees
the connection's segments, so it cannot judge their numbers - and a sloppy state takes a reset at its
word. Measured on both appliances: a reset with its sequence number 64 MiB outside the window - what a
blind reset looks like - turned the connection's pf states to TIME_WAIT, and an idle connection was
dead a hundred seconds later, its next line never arriving: a state in TIME_WAIT expires at
tcp.closed, 90 seconds after the connection's last frame, where an established one lasts a day.
The whole page, with how it was taken and what it does not show: A blind reset into a connection in hardware, judged by pf again, measured, 2026-10-24.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.