Subject: [BEHAVE] Question on TCP Probe packet definition in Stateful NAT64

From: Reinaldo Penno <[email-masked]>
Date: Tue, 9 Mar 2010 23:14:14 -0500

Stateful NAT64 defines the TCP probe packets as

"  The probe packet is a TCP segment for the connection with no data.
   The sequence number and the acknowledgment number are set to zero.
   All flags but the ACK flag are reset."

Note the part that it says the seq and ack are set to zero.

But a TCP keep alive message is defined differently in RFC 1122.

" To confirm that an idle
   connection is still active, these implementations send
   a probe segment designed to elicit a response from the
   peer TCP.  Such a segment generally contains SEG.SEQ =
   SND.NXT-1 and may or may not contain one garbage octet
   of data.  Note that on a quiet connection SND.NXT =
   RCV.NXT, so that this SEG.SEQ will be outside the
   window.  Therefore, the probe causes the receiver to
   return an acknowledgment segment, confirming that the
   connection is still live.  If the peer has dropped the
   connection due to a network partition or a crash, it
   will respond with a RST instead of an acknowledgment
   segment."

RFC5382 (NAT Behavioral Requirements for TCP) also mention TCP keep-alive
packet as defined in RFC-1122.

I'm curious, is this probe packet something different defined elsewhere? Has
anyone verified if actual top N web servers reply with an ACK for such
packet?

Thanks,

Reinaldo

Thanks,

Reinaldo