Stateful connections dropping out after 1 minute?

[Andrew.Furey]

Hi all,

We have a problem here that's been driving us batty.

We have a bunch of XP laptops (all SP2 I'm fairly sure) which are on a
regular 100Mb LAN in a domain. At intermittent times (ie. haven't
narrowed down the cause yet) the system will refuse to keep any idle
TCP connections open for longer than 60 seconds.

The problem itself is easy to reproduce:

* open an command prompt
* telnet to a server on the LAN (of which we have several, we use a
telnet-based thin client for our core business)
* login to the server
* press Enter or something to cause some activity, and start a
stopwatch at the same time
* roughly one minute and one second later, press some other key
* the connection has stopped updating and will drop out in a few
seconds

The telnet session is still active on the server as if nothing had
happened, but of course there's no way to get to it so it's useless.

So far we know that:

* it's not due to NAT since it happens on a direct LAN to a server on
the same subnet. Nothing unusual here.
* it's not the network connection at either end being shut down due to
inactivity, since running a ping to the same server at the same time
will work with no interruptions, but does not prevent the dropout
* it's not the computer itself going to sleep since moving the mouse
around, even working on other tasks, will not prevent the dropout.
(This is the usual way we notice it, we go off and do something in
another window for a couple of minutes and come back to a dead
session.)

We also have a number of proprietary VPN programs intalled (RSA's
Checkpoint, Cisco's Global VPN client, etc). We thought these might be
the issue but we've tried installing and uninstalling them in various
combinations; nothing reproducible for this problem. On one of the
machines I was testing on, uninstalling one of them (I forget which)
and rebooting fixed the problem that had been occurring at the time,
only to have it mysteriously break again the next day.

None of the machines use ICS (no need, they're all on the same LAN),
and the Windows firewall settings seem to make no difference. Windows
patch versions also seem to be disaparate enough to be ruled out - it
only seems to affect about 1/3 of the machines in the office, and not
all the time.

Any ideas?

TIA
Andrew

 

[Andrew.Furey]

The problem itself is easy to reproduce:

* open an command prompt
* telnet to a server on the LAN (of which we have several, we use a
telnet-based thin client for our core business)
* login to the server
* press Enter or something to cause some activity, and start a
stopwatch at the same time
* roughly one minute and one second later, press some other key
* the connection has stopped updating and will drop out in a few
seconds

The telnet session is still active on the server as if nothing had
happened, but of course there's no way to get to it so it's useless.

[snip]

OK, I've finally managed to narrow it down - the dropping itself is
being caused by CheckPoint SecuRemote VPN software (one of the VPNs
mentioned), and specifically if the Windows service that accompanies
it is not running. (We stop the service by default since it blocks
traffic in private IP ranges, which messes up other aspects of our
networking).

The tricky part is that it's only triggered when switching to another
network (via DHCP at least) with a different IP range. The problem
occurs if:

* the machine is changed on-the-fly (within the one Windows session);
or
* the machine is changed during hibernation (hibernate while on one
network, resume when you've connected to another); or
* the machine is changed across reboots (shut down cleanly on one
network, boot from scratch on another).

All of these will cause the problem to appear (the last one in
particular seems really odd). However, if you plug into the new
network while the machine is up (or has just been booted), *shut
down*, and then boot up again while still on that network, the problem
goes away. There seems to be something in the shutdown process that
Checkpoint flushes.

Another workaround (apart from uninstalling Checkpoint) is to turn off
the "Checkpoint SecuRemote" item on the network adapter itself - but
then Checkpoint doesn't work, so that's not really acceptable either.

I'm going to follow up with the client who use Checkpoint, and
possibly go to the developers themselves, to see if one or the other
of the problems can be sorted out.

Regards,
Andrew