Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 17 Dec 2002 15:51:27 -0700
From:      "Aaron D. Gifford" <>
Subject:   Some IPFW2 stateful dynamic rules won't go away
Message-ID:  <>

Next in thread | Raw E-Mail | Index | Archive | Help

I've got a box with a three month old version of -STABLE on it that's 
been up for about 80 days.  It uses IPFW2.  This box delivers a bit of 
e-mail each day (perhaps 150,000-200,000 deliveries/day) and doesn't 
really do much else.

Recently it was brought to my attention that a few IPFW2 dynamic 
stateful tcp rules were hanging around for an excessive amount of time. 
  Two TCP sessions had apparently been created three weeks ago by the 
mail server, and somehow the dynamic stateful rules that were created by 
the sessions have persisted for three weeks, sending out the IPFW2 
generated TCP keep-alive packets every 5 minutes.  On the local mail 
server side, netstat shows the relevant TCP sockets in the FIN_WAIT_2 
state.  On the remote side, the admin's firewall logs kept showing TCP 
ACK packets arriving every 5 min (the keep-alives, I presume).

SO now the questions:

1) Are there IPFW2 changes in the past 90 days MFCd to -STABLE that 
would fix this?  Either way, I will be upgrading to a newer kernel/IPFW2.

2) What sequence of events could have resulted in this state of things 
in the first place?  Hmmm...  Okay, the TCP session was ESTABLISHED, the 
local box sends FIN to close things, the remote side ACKs the FIN so now 
the local socket is in FIN_WAIT_2.  The remotely sent FIN gets dropped 
somewhere on the Internet.  The remote side's own firewall at some point 
decides to expire their temp. dynamic rule or whatever.  Now my local 
box's IPFW2 counter runs down and generates an ACK in both directions, 
keeping the local socket in FIN_WAIT_2 forever, and the ACK sent to the 
remote side gets silently dropped by their firewall.  Is this plausible? 
   If so, what's to prevent this from happening again?


Aaron out... (off to upgrade to a newer kernel on the box in question)

To Unsubscribe: send mail to
with "unsubscribe freebsd-ipfw" in the body of the message

Want to link to this message? Use this URL: <>