PQ70634: TCP LAYER SENDS PACKET WITH BOTH SYN AND RST FLAGS ON WHEN CONNECTION ESTABLISHMENT TIMEOUT OCCURS

APAR status

• Closed as fixed if next.

Error description

• During tcp connect processing the remote host is not responding
  to syn packets. Eventually the connection processing times
  about three minutes later. At this point a packet with both
  syn and rst flags on is sent to the remote host. Some Firewalls
  have been setup to not forward packets with those two flags
  both being on.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of the Communications Server for   *
  *                 OS/390 Release 10 IP and                     *
  *                 z/OS Version 1 Release 2 & 4 IP              *
  ****************************************************************
  * PROBLEM DESCRIPTION: Outbound TCP packets have the SYN and   *
  *                      RST flags on in the same packet.        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The TCP layer will determine a connection should be reset and
  builds an outbound packet with the RST flag set on.  The SYN and
  FIN flags from the previous outbound packet on the connection
  will remain unchanged.  This may result in SYN/RST or FIN/RST
  flag combination being on in the packet.  The flag combination
  is not a violation of the TCP protocol.
  There are several references on the internet that indicate the
  flag combination may be an attempt at intrusion and should thus
  be discarded.
  
  +-------------------------------------------------------------+
  + Please check our Communications Server for OS/390 homepages +
  + for common networking tips and fixes.  The URL for these    +
  + homepages can be found in Informational APAR II11334.       +
  +-------------------------------------------------------------+
  

Problem conclusion

Temporary fix

Comments

• This APAR is being closed FIN (Fixed If Next) with concurrence
  from the submitting customer. This means that a fix to this
  APAR is expected to be delivered from IBM in a release (if any)
  to be available within the next 18 months.
  
  This problem will be tracked as PTR MV27704 by Communications
  Server for z/OS Development.
  
  PTR27704   PTR 27704
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

• R120 PSN

     UP

• R140 PSN

     UP

• R50A PSN

     UP