I have a ppp server (1.4.2/i386) acting as a gateway between the
internet and a dialup line.  Most protocols seem to work fine (e.g., I
can ping/traceroute/ftp/telnet all over the net), so I think the
routing is being handled fine and the basic setup is ok.

However, establishing connections via http are eratic; some "nearby"
hosts work fine, others get lost.  My naive watching with tcpdump
suggests that packets that enter the gateway via the ethernet
interface (we0) don't always get forwarded to the ppp (ppp0)
interface.  On the other hand, all packets from the ppp interface seem
to be forwarded to the ethernet interface.

For example, the two sequences below record packets simultaneously
from each of the two interfaces on the ppp server that result from
executing the command ftp http://www.netbsd.org/Index.html from a box
connected via the ppp link.  It seems to me that the first 5 packets
are forwarded, 1 is lost, 2 are forwarded, a bunch are lost, and the
last two (resulting from ^C exit from ftp) are forwarded.

I presume the lost packets are responsible for the fact that http
connections are not reliably set up (which they weren't in this
particular case).  Is this a correct interpretation?  However, I have
no idea what to do about it.

What could prevent a packet from begin forwarded from the ethernet
interface to the ppp interface?  What tools should I be using to track
down the fate of those packets?  Is this even on the right track?

Any help is fixing this problem is welcome.

Thanks,
Brook

===========================================================================

linum# tcpdump -vv -n host larix and www.netbsd.org
tcpdump: listening on we0
23:11:16.633279 128.123.5.17.65482 > 204.152.186.171.80: S 2727948944:2727948944(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp[|tcp]> (ttl 63, id 6799)
23:11:16.637056 204.152.186.171.80 > 128.123.5.17.65482: S 4172585076:4172585076(0) ack 2727948945 win 32120 <mss 1460,nop,nop,timestamp 12552554[|tcp]> (DF) (ttl 63, id 30500)
23:11:16.946627 128.123.5.17.65482 > 204.152.186.171.80: . [tcp sum ok] ack 1 win 17520 <nop,nop,timestamp 27475 12552554> (ttl 63, id 6800)
23:11:17.095120 128.123.5.17.65482 > 204.152.186.171.80: P 1:116(115) ack 1 win 17520 <nop,nop,timestamp 27475 12552554> (ttl 63, id 6801)
23:11:17.099488 204.152.186.171.80 > 128.123.5.17.65482: . [tcp sum ok] ack 116 win 32005 <nop,nop,timestamp 12552600 27475> (DF) (ttl 63, id 30594)
23:11:17.172548 204.152.186.171.80 > 128.123.5.17.65482: P 1:508(507) ack 116 win 32120 <nop,nop,timestamp 12552608 27475> (DF) (ttl 63, id 30638)
23:11:17.173426 204.152.186.171.80 > 128.123.5.17.65482: F [tcp sum ok] 508:508(0) ack 116 win 32120 <nop,nop,timestamp 12552608 27475> (DF) (ttl 63, id 30639)
23:11:17.417360 128.123.5.17.65482 > 204.152.186.171.80: . [tcp sum ok] ack 1 win 17520 <nop,nop,timestamp 27476 12552554> (ttl 63, id 6802)
23:11:20.172089 204.152.186.171.80 > 128.123.5.17.65482: FP 1:508(507) ack 116 win 32120 <nop,nop,timestamp 12552908 27476> (DF) (ttl 63, id 31592)
23:11:26.171810 204.152.186.171.80 > 128.123.5.17.65482: FP 1:508(507) ack 116 win 32120 <nop,nop,timestamp 12553508 27476> (DF) (ttl 63, id 32837)
23:11:38.121346 204.152.186.171.80 > 128.123.5.17.65482: FP 1:508(507) ack 116 win 32120 <nop,nop,timestamp 12554708 27476> (DF) (ttl 63, id 34824)
23:11:48.990955 204.152.186.171.80 > 128.123.5.17.65483: FP 3755442608:3755443115(507) ack 2122631763 win 32120 <nop,nop,timestamp 12555795 27011> (DF) (ttl 63, id 36202)
23:11:54.560673 204.152.186.171.80 > 128.123.5.17.65487: FP 3393293161:3393293662(501) ack 3052939012 win 32120 <nop,nop,timestamp 12556356 25987> (DF) (ttl 63, id 36851)
23:12:02.080459 204.152.186.171.80 > 128.123.5.17.65482: FP 1:508(507) ack 116 win 32120 <nop,nop,timestamp 12557108 27476> (DF) (ttl 63, id 37914)
23:12:13.080031 204.152.186.171.80 > 128.123.5.17.65484: FP 3661707601:3661708109(508) ack 3172292110 win 32120 <nop,nop,timestamp 12558208 26629> (DF) (ttl 63, id 39132)
23:12:29.339370 204.152.186.171.80 > 128.123.5.17.65486: FP 3424812859:3424813359(500) ack 4238159468 win 32120 <nop,nop,timestamp 12559834 26211> (DF) (ttl 63, id 42182)
23:12:50.048618 204.152.186.171.80 > 128.123.5.17.65482: FP 1:508(507) ack 116 win 32120 <nop,nop,timestamp 12561908 27476> (DF) (ttl 63, id 45661)
23:13:05.291896 128.123.5.17.65482 > 204.152.186.171.80: F [tcp sum ok] 116:116(0) ack 1 win 17520 <nop,nop,timestamp 27692 12552554> (ttl 63, id 6849)
23:13:05.295712 204.152.186.171.80 > 128.123.5.17.65482: . [tcp sum ok] ack 117 win 32120 <nop,nop,timestamp 12563435 27692> (DF) (ttl 63, id 47436)


linum# tcpdump -vv -n -i ppp0 host larix and www.netbsd.org
tcpdump: listening on ppp0
23:11:16.631427 128.123.5.17.65482 > 204.152.186.171.80: S [tcp sum ok] 2727948944:2727948944(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 27474 0> (ttl 64, id 6799)
23:11:16.638879 204.152.186.171.80 > 128.123.5.17.65482: S [tcp sum ok] 4172585076:4172585076(0) ack 2727948945 win 32120 <mss 1460,nop,nop,timestamp 12552554 27474,nop,wscale 0> (DF) (ttl 62, id 30500)
23:11:16.942966 128.123.5.17.65482 > 204.152.186.171.80: . [tcp sum ok] ack 1 win 17520 <nop,nop,timestamp 27475 12552554> (ttl 64, id 6800)
23:11:17.093066 128.123.5.17.65482 > 204.152.186.171.80: P 1:116(115) ack 1 win 17520 <nop,nop,timestamp 27475 12552554> (ttl 64, id 6801)
23:11:17.101291 204.152.186.171.80 > 128.123.5.17.65482: . [tcp sum ok] ack 116 win 32005 <nop,nop,timestamp 12552600 27475> (DF) (ttl 62, id 30594)
23:11:17.178554 204.152.186.171.80 > 128.123.5.17.65482: F [tcp sum ok] 508:508(0) ack 116 win 32120 <nop,nop,timestamp 12552608 27475> (DF) (ttl 62, id 30639)
23:11:17.415512 128.123.5.17.65482 > 204.152.186.171.80: . [tcp sum ok] ack 1 win 17520 <nop,nop,timestamp 27476 12552554> (ttl 64, id 6802)
23:13:05.290013 128.123.5.17.65482 > 204.152.186.171.80: F [tcp sum ok] 116:116(0) ack 1 win 17520 <nop,nop,timestamp 27692 12552554> (ttl 64, id 6849)
23:13:05.297550 204.152.186.171.80 > 128.123.5.17.65482: . [tcp sum ok] ack 117 win 32120 <nop,nop,timestamp 12563435 27692> (DF) (ttl 62, id 47436)