Re: Comments on draft-ietf-ipsec-new-auth-00.txt

[Thomas Narten <narten@xxxxxxxxxxxxxxx>]

> That's 6.4 percent on elgreco, and 2.3 percent on janus, of all data packets
> received out-of-order. I wouldn't define that as "rare", especially given the
> (additional) performance penalties for dropping them instead of queueing them.

Are these "netstat -s" numbers that come from a BSD-derived TCP stack?
If so, I believe that numbers like:

                198927 out-of-order packets (40226774 bytes)

also include TCP segments that arrive *after* a packet loss, i.e.,
they are out of order in the sense that they aren't the packet TCP
expects to see next. However, they aren't out of order in the sense
that the missing packet will arrive later due to reordering by the
network. More likely, the missing segment was lost and needs to be
retransmitted.  So unless I'm mistaken about what this stat means, I
don't think it counts the right quantity (unfortunately).

Thomas