Check a packet dump and see if your affected boxes are sending SWE (SYN
with ECN enabled) instead of plain SYN packets. Some firewalls (at least
default m0n0wall and older PIX) reject and dump ECN syn packets while
allowing pure syns through. If your affected peer has you running
through some weird filter that's dropping SWE packets, this would cause
symptoms exactly as you're seeing - ping is fine, traceroute is fine,
but TCP sessions never complete the handshake (as the receiving side
never got the first SYN).
- J