Date: Thu, 15 May 2008 12:29:15 +1200 From: "Mark Pagulayan" <m.pagulayan@auckland.ac.nz> To: "Jille" <jille@quis.cx> Cc: freebsd-pf@freebsd.org Subject: RE: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules Message-ID: <C65291A68BAF57499B18564A1EE4A761370E5A@UXCHANGE1.UoA.auckland.ac.nz> In-Reply-To: <482B80D3.4010701@quis.cx> References: <C65291A68BAF57499B18564A1EE4A761370E38@UXCHANGE1.UoA.auckland.ac.nz> <fee88ee40805141613k685c1536w9fc72e88aaa9f746@mail.gmail.com> <482B7BE6.9080608@uffner.com> <C65291A68BAF57499B18564A1EE4A761370E53@UXCHANGE1.UoA.auckland.ac.nz> <482B80D3.4010701@quis.cx>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Jill,=20 I am using bridge pf: I only allow pass all on my internal interface. So there is no other rule for that interface. How do I know that states are mismatched for both internal and external?=20 Cheers,=20 Mark -----Original Message----- From: Jille [mailto:jille@quis.cx]=20 Sent: Thursday, 15 May 2008 12:16 p.m. To: Mark Pagulayan Cc: Tom Uffner; Kian Mohageri; freebsd-pf@freebsd.org Subject: Re: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules Hello, Mark Pagulayan schreef: > Hi Tom,=20 > > I have just zeroed in the statistics and yes the state-mismatch is still > increasing.=20 > > If I do enable logging, how would I know that packet is mismatched?=20 > =20 If you use tcpdump, the standard flags will also show what rule it matched, so if it is an 'pass all' rule, it mismatched your other rule. -- Jille > Cheers,=20 > > Mark > -----Original Message----- > From: Tom Uffner [mailto:tom@uffner.com]=20 > Sent: Thursday, 15 May 2008 11:55 a.m. > To: Kian Mohageri > Cc: Mark Pagulayan; freebsd-pf@freebsd.org > Subject: Re: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules > > Kian Mohageri wrote: > =20 >> On Wed, May 14, 2008 at 3:45 PM, Mark Pagulayan >> =20 >>> The way I see this is that this rule would be applied to udp traffic >>> =20 > as > =20 >>> well which will be dropped/blocked because flags only work for tcp >>> =20 > and > =20 >>> this might be the cause of state-mismatches that I see in the table - >>> =20 >> 'flags S/SA keep state' will work OK for UDP too. Only the 'keep >> state' part will be applied to UDP, since no flags are involved. >> >> =20 >>> state-mismatch 11577272 48.7/s >>> =20 >> Could be caused by reloading your ruleset to include 'keep state' >> mid-connections, I think. PF won't be aware of where the state is >> (especially true if you're using TCP window scaling), so it will fail >> after a while and you'll see state mismatches. >> =20 > > even if reloading the ruleset to include "keep state" and/or "flags > s/sa" > didn't sever pre-existing connections, it shouldn't cause that large a > number of mismatches. > > when was the last time you zeroed the statistics? is the mismatch count > still increasing w/ the 7.0 stateful rules? you may need to add "log > (all)" > to find out where the state mismatches are coming from. > _______________________________________________ > freebsd-pf@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org" > =20
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?C65291A68BAF57499B18564A1EE4A761370E5A>