Re: --log-uid target?

[John Lange <john.lange@bighostbox.com>]

Thanks for the information Patrick.

Unfortunately I don't know enough about the underlying TCP layer to
translate your email into english :)

Basically, what I have understood you to have said is that my kernel is
generating a RST packet in response to a host trying to make a
connection to it on a non-existent socket and it is sending this reply
to the host on port 25.

RST packet being something used to "tear down" a TCP connection in a
hurry, for example when the port you are connecting isn't listening.

Here is what I don't understand, why are these hosts trying to connect
to a non-existent port and, why would the RST be destined for port 25?

Obviously I don't understand how this works. I assume incoming
connections are usually from a random high port (for most things) and so
the RST would be sent back to that same port?

What service could be originating connections on port 25 and what would
they be trying to connect to that isn't available?

If you have an theory's about what is going on here I'd be grateful if
you could pass them along to me.

Thanks,
-- 
John Lange



On Wed, 2004-11-03 at 21:30, Patrick McHardy wrote:
> John Lange wrote:
> 
> >Actually, Martin supplied me with the old patch from 2002 which I
> >modified to work with 2.6.9 and I sent them back to him for review.
> >
> >I have been using it on 2 production systems since The weekend and so
> >far everything seems good.
> >
> >There is one problem though, though I have this line in my firewall
> >script:
> >
> >/usr/local/sbin/iptables -A OUTPUT -p tcp --dport 25 -j LOG --log-prefix
> >"SMTP " --log-uid
> >
> >A great deal of packets are being logged with NO UID as follows:
> >
> >Nov  3 20:16:50 venus kernel: SMTP IN= OUT=eth0 SRC=209.xxx.xxx.xxx
> >DST=203.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=8368 DF
> >PROTO=TCP SPT=39737 DPT=25 WINDOW=0 RES=0x00 RST URGP=0
> >
> >The target does in fact work at least some of the time because there are
> >also plenty of packets logged like this:
> >
> >Nov  3 20:25:45 venus kernel: SMTP IN= OUT=eth0 SRC=209.xxx.xxx.xxx
> >DST=64..xxx.xxx.xxx LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=7784 DF
> >PROTO=TCP SPT=39780 DPT=25 WINDOW=1460 RES=0x00 ACK URGP=0 UID=500 
> >
> >UID=500 is what i expect since thats my SMTP server uid.
> >
> >Under what situations could an outgoing packet be logged without a UID?
> >Something must own this packet?
> >  
> >
> When the kernel replies to packets itself there is no UID.
> RSTs sent in response to a packet addressed to a non-existant
> socket have no (user) socket, that's why the RST is sent :)
> Same for ICMP messages generated by the kernel. You should
> see the UID for all packets sent from userspace.
> 
> Regards
> Patrick