Date: Wed, 2 Aug 2006 16:26:11 +0200 From: Max Laier <max@love2party.net> To: Frank Steinborn <steinex@nognu.de> Cc: freebsd-pf@freebsd.org Subject: Re: I'm getting sick - Problems filtering IPv6. Message-ID: <200608021626.21964.max@love2party.net> In-Reply-To: <20060802142129.D0BBDB81E@shodan.nognu.de> References: <20060801142925.54F5CB828@shodan.nognu.de> <200608021601.49038.max@love2party.net> <20060802142129.D0BBDB81E@shodan.nognu.de>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1283078.kltt9RE5x8 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Wednesday 02 August 2006 16:21, Frank Steinborn wrote: > Max Laier wrote: > > > Hello Max, > > > > > > a state is created, yes: > > > > > > self tcp 2001:1638:17ad::3[53] <- 2001:1638:17ad::3[62810] > > > SYN_SENT:ESTABLISHED > > > [342525613 + 65536](+2469478632) wscale 1 [3355548528 + > > > 65537](+82545723) wscale 1 > > > [1845438366 + 4880](+1776883750) [3423429433 + 65535](+3331864375) > > > age 00:37:53, expires in 00:00:59, 2204:15980 pkts, 107106:2269450 > > > bytes > > > age 01:22:57, expires in 00:01:00, 5472:42944 pkts, 324485:6199453 > > > bytes > > > age 02:00:22, expires in 00:00:59, 11249:53620 pkts, 967458:7637333 > > > bytes > > > > > > > > > Strange thing :-( > > > > Indeed, and far from what I expected to see. These states exist for a > > long time and have seen lots of packets in both directions. Are you su= re > > you copied the right counters for that state? Can you please enable > > extended logging with "pfctl -x misc" and report any related messages > > from console. Also, please recheck pfctl -vss for the right state > > counters. I do get this right, the "telnet 2001:1638:17ad::3 53" stall= ed > > right away? > > You are correct, I probably tried to many telnets so that states are > left. I did it again, and here is the state from the telnet: > > self tcp 2001:1638:17ad::3[53] <- 2001:1638:17ad::3[59655] > SYN_SENT:ESTABLISHED > [2728554970 + 65536](+2360520929) wscale 1 [1947983223 + > 65537](+3290820275) wscale 1 > age 00:00:02, expires in 00:00:28, 1:1 pkts, 84:84 bytes, rule 45 > > There is nothing logged on the console due to pfctl -x misc, so i > tried pfctl -x loud. However, the only thing i see are some > > "fingerprinted 84.191.87.127:64944 8576:118:0:48:403 (4) > (TS=3D,M=3D536,W=3D0)" (IP's vary, of course, can't find v6 however) > > and > > "osfp no match against 3400000". > > But i guess that's not important here. > > And yes, you got it right - if I "telnet 2001:1638:17ad::3 53" it just > stalls and times out after some time (even when i try block-policy > return). But only on the box itself where pf and named is running, > other boxes can access it fine. I have to try to reproduce this locally. What version are you running agai= n? Anyone seen similar things? =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart1283078.kltt9RE5x8 Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (FreeBSD) iD8DBQBE0LYNXyyEoT62BG0RAoSkAJ9Ff0a0frkpKl2LBCuVCPY5xS5RVwCfTKxo LloeM6d3EkQBz791TeDO+rI= =O/Uy -----END PGP SIGNATURE----- --nextPart1283078.kltt9RE5x8--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200608021626.21964.max>