Subject: How should NATs reject TCP packets? (WAS:: Re: [Ietf-behave] Next rev on TCP Behavior)

From: Pyda Srisuresh <[email-masked]>
Date: Wed, 20 Apr 2005 18:53:03 -0700 (PDT)

--- Saikat Guha <sg266@xxxxxxxxxxx> wrote:
> On Mon, 2005-04-18 at 17:26 -0700, Senthil Sivakumar wrote:
> > Does either of these messages cause the originating host to behave
> differently?
> > I think sending a RST or ICMP Unreachable would not prevent a host app from
> 
> > retrying a number of times (it is programmed to retry), right? 
> 
> There are a couple of minor differences. Error values returned from the
> socket functions is different: ECONNREFUSED for RST vs. EHOSTUNREACH for
> ICMP host unreachable, which in turn generates different error strings
> "Connection refused" vs. "No route to host" respectively. 
> 
> According to RFC1122 btw, ICMP host unreachable _must_ be soft, ICMP
> port unreachable _should_ be hard and RST _must_ be hard. Then again,
> Linux doesn't retry on some soft errors (host unreach in SYN_SENT) and
> windows retries on some hard errors (RST in SYN_SENT) ... so retries in
> the stack is unpredictable as it is. :-p
> 
[suresh] Unfortunately, RFC 1122 doesnt discuss ICMP code 10 upon receipt. I
believe, code 10 shold be treated as soft error. What do folks think about
using code 10 for NAT/firewall rejects?
 
> -- 
> Saikat

cheers,
suresh