Bridging problems (ath & vr)

[Martijn van Buul <pino%dohd.org@localhost>]

Hi,

I'm having a strange networking problem, and I'm hoping that someone could
help me out:

My home router (running NetBSD 5.1-RC3, but I had exactly the same problems
with 5.0.1) has a wireless (ath0) and a wired network card (vr1) in a bridge.
ath0 is managed by hostapd.

This seems to work quite well with most wireless devices I own (netbooks,
wii..), but it's always been finicky with iPhones and Android devices - 
including my e-book reader (a Barnes & Noble Nook). These devices work OK
if I split my wireless- and wired network into two distinct networks, but
not when in a bridge.

I dumped some traffic from the nook earlier today, and noticed a lot of
TCP retransmissions whose data never get ACKed:

19:14:41.128896 IP nook.pienjo.invalid.46134 > bnreview.lithium.com.http: S 
1735366129:1735366129(0) win 5840 <sackOK,timestamp 14130110 0,mss 
1460,nop,wscale 1>
19:14:41.297171 IP bnreview.lithium.com.http > nook.pienjo.invalid.46134: S 
2804338707:2804338707(0) ack 1735366130 win 4380 <mss 1460,nop,wscale 
0,nop,nop,timestamp 3547428903 14130110,sackOK,eol>
19:14:41.303170 IP nook.pienjo.invalid.46134 > bnreview.lithium.com.http: . ack 
1 win 2920 <nop,nop,timestamp 14130144 3547428903>
19:14:41.868742 IP nook.pienjo.invalid.46134 > bnreview.lithium.com.http: P 
1:411(410) ack 1 win 2920 <nop,nop,timestamp 14130228 3547428903>
19:14:42.046464 IP bnreview.lithium.com.http > nook.pienjo.invalid.46134: P 
1:1449(1448) ack 411 win 4790 <nop,nop,timestamp 3547429651 14130228>
19:14:42.046611 IP bnreview.lithium.com.http > nook.pienjo.invalid.46134: P 
1449:2897(1448) ack 411 win 4790 <nop,nop,timestamp 3547429651 14130228>
19:14:42.046801 IP bnreview.lithium.com.http > nook.pienjo.invalid.46134: P 
2897:4345(1448) ack 411 win 4790 <nop,nop,timestamp 3547429652 14130228>
19:14:42.278291 IP nook.pienjo.invalid.46134 > bnreview.lithium.com.http: P 
1:411(410) ack 1 win 2920 <nop,nop,timestamp 14130330 3547428903>
19:14:42.446348 IP bnreview.lithium.com.http > nook.pienjo.invalid.46134: P 
4345:5793(1448) ack 411 win 4790 <nop,nop,timestamp 3547430051 14130330>
19:14:43.246110 IP bnreview.lithium.com.http > nook.pienjo.invalid.46134: . 
1:1449(1448) ack 411 win 4790 <nop,nop,timestamp 3547430851 14130330>
19:14:43.407657 IP nook.pienjo.invalid.46134 > bnreview.lithium.com.http: P 
1:411(410) ack 1 win 2920 <nop,nop,timestamp 14130534 3547428903>
19:14:43.575534 IP bnreview.lithium.com.http > nook.pienjo.invalid.46134: P 
5793:5841(48) ack 411 win 4790 <nop,nop,timestamp 3547431181 14130534>

(I can make the capture file available, if this helps). Not *all* traffic
gets damaged; based on what I see in the rest of the capture file, smaller
packets seem to work OK, but larger packets seem to fail. However, this is
based on a rather small sample. 

Any idea what is going wrong? Like said, everything works fine if I put
ath0 in its own network. 

ifconfig:

vr1: flags=8b43<UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 
1500
        address: 00:0d:b9:16:0f:b9
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
        inet6 fe80::20d:b9ff:fe16:fb9%vr1 prefixlen 64 scopeid 0x2
        inet6 2001:610:1108:5220::1 prefixlen 64
ath0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        ssid pienjo2 nwkey *****
        powersave off
        bssid 00:05:4e:44:1d:90 chan 3
        address: 00:05:4e:44:1d:90
        media: IEEE802.11 autoselect mode 11g hostap
        status: active
        inet6 fe80::205:4eff:fe44:1d90%ath0 prefixlen 64 scopeid 0x3
bridge0: flags=41<UP,RUNNING> mtu 1500

I do need to point out that I had to manually reconfigure ath0's MTU; the
bridge is created before hostapd starts, and starting hostapd bumps it to
2290. If hostapd is started before the bridge is constructed, brconfig will
refuse to add ath0. I can't raise the MTU of vr1 any further. 

Unfortunately, my posibilities to debug things on the nook are very limited.

Any suggestions are welcome. I would like to keep vr1 and ath0 in a bridge
if possible, I'm using ipv6 with autoconfiguration on a /64 range, which
means I can't split it. Furthermore, there's a Windows 7 desktop in my 
network, whose firewall I can't seem to convince that my home network is 
bigger than its netmask..

Thanks in advance,

Martijn
-- 
Martijn van Buul - pino%dohd.org@localhost