Date: Tue, 27 Jan 2015 19:17:34 +1100 From: Aristedes Maniatis <ari@ish.com.au> To: Dimitry Andric <dim@freebsd.org> Cc: freebsd-pf@freebsd.org Subject: Re: meaning of State-mismatch Message-ID: <54C7499E.6090805@ish.com.au> In-Reply-To: <8A242C55-A2D7-49C2-A0CC-AFB1E447C494@FreeBSD.org> References: <54C72F63.8040908@ish.com.au> <CD5F0D06-3738-4786-97C6-68C27D94A5B0@FreeBSD.org> <54C74303.1070601@ish.com.au> <8A242C55-A2D7-49C2-A0CC-AFB1E447C494@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 27/01/2015 7:07pm, Dimitry Andric wrote: > On 27 Jan 2015, at 08:49, Aristedes Maniatis <ari@ish.com.au> wrote: >> >> On 27/01/2015 6:46pm, Dimitry Andric wrote: >>> On 27 Jan 2015, at 07:25, Aristedes Maniatis <ari@ish.com.au> wrote: >>>> >>>> I have been unable to find much documentation about the counter called "state-mismatch". I notice it going up on my firewall (FreeBSD 10.1) but only at a slow rate (maybe at around 1 per minute). >>>> >>>> What is the significance of this value? Is it indicative of dropped states (and I should be increasing the state timeout)? >>> >>> It's not really documented in our pfctl(8) manpage, but the OpenBSD version does >>> mention it: >>> >>> state-mismatch >>> packet was associated with a state entry, but sequence numbers did not >>> match >>> >>> So maybe something is dropping packets, making holes in the sequence numbers? Or >>> maybe somebody is trying something sneaky? :) >>> >>> -Dimitry >> >> Ah, thanks for that. Maybe you could add that doc to the FreeBSD man page. Could it simply be a packet loss issue where a packet is lost and the next packet arrives out of order? > > Well, that is just a likely cause. If you let tcpdump run for a while, > you might be able to spot it, in e.g. Wireshark? > > -Dimitry > If I attach tcpdump to pflog0 is there an easy way to filter for just these events? I assume there is nothing like "block in log flags state-mismatch" to trap these packets? If I knew which IP and port they were going to, I'd have a better idea of where to look. Ari -- --------------------------> Aristedes Maniatis ish http://www.ish.com.au Level 1, 30 Wilson Street Newtown 2042 Australia phone +61 2 9550 5001 fax +61 2 9550 4001 GPG fingerprint CBFB 84B4 738D 4E87 5E5C 5EFA EF6A 7D2E 3E49 102A
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?54C7499E.6090805>