3 ms·

Ask HN: Why is iOS 17 setting TCP reserved bit?

13 points by GGO 3y ago

I started using iOS 17 beta and I am noticing that websites take long to load. I looked at my firewall logs and it looks like safari on new iOS is setting reserved bit in which firewall's IPS engine is blocking right away: Invalid TCP reserved bit. This is not happening on iOS 16. Is there some hidden TCP change with iOS 17 that is now secretly using those TCP reserved bits?

mikequinlan 3y ago
Are you using iCloud Private Relay? Is it possible that their third-party content provider is setting that?
- GGO 3y ago
  All I did was to upgrade to iOS 17. did not install anything new. Also I dont use private relay and I also dont have limit IP tracking enabled on my home wifi.
Ocha 3y ago
Would be nice to see a TDP dump of before and after upgrade. Is there a way to get it on iOS?
- stop50 3y ago
  You could get the dump from the other side. You only need the tcpdump program, the port doesn't even need to be open
dtaht 3y ago
Which TCP reserved bit? ECN? The reserved fields in the ack?
- GGO 3y ago
  I don't know. I don't have raw packet. just the log in firewall that does not specify which bit.
  - toast0 3y ago
    We can't help much without a raw packet. Can you get a capture from the firewall? Or failing that, setup some other way to capture packets (does iOS do reverse tethering? or you can setup a different wifi access point and capture packets between that and the firewall, etc)
- Ocha 3y ago
  Since it is firewall dropping the packet, and during initial connection (that’s why websites load slow), I doubt it’s ECN. Firewall would know about ECN.
Ocha 3y ago
TIL there is TCP reserved bits
- bombcar 3y ago
  Maybe they’re setting the evil bit. https://news.ycombinator.com/item?id=36330116 https://news.ycombinator.com/item?id=36330116
wmf 3y ago
I wonder if this is L4S. https://developer.apple.com/documentation/network/testing_and_debugging_l4s_in_your_app https://developer.apple.com/documentation/network/testing_an...
- GGO 3y ago
  I checked - L4S is off and makes no difference if I enable or disable it.