From: Patrick McHardy <kaber@trash.net>
To: Meelis Roos <mroos@linux.ee>
Cc: netdev@vger.kernel.org,
Netfilter Development Mailinglist
<netfilter-devel@lists.netfilter.org>
Subject: Re: ipv4_get_l4proto: Frag of proto 17
Date: Sat, 01 Sep 2007 07:28:26 +0200 [thread overview]
Message-ID: <46D8F87A.1080604@trash.net> (raw)
In-Reply-To: <Pine.SOC.4.64.0708301557400.9520@math.ut.ee>
Meelis Roos wrote:
>>> Yesterdays git snapsot on a normal home PC spams dmesg with the following
>>> line:
>>> ipv4_get_l4proto: Frag of proto 17
>> In what situation does this happen?
>
> It happens some times every hour on the average. Seems to be some UDP
> traffic. Firewall allows in any UDP that is ESTABLISHEFD,RELATED, DHCP
> (some more UDP rules with counter 0 so not important). Additionally
> there is internal netowkr that sometimes has a laptop but usually not
> and the messages have appeared also when there is nothin in the internal
> network.
>
> Locally mldonkey is probably using UDP, and lsof -i | grep UDP tells
> that named, avahi-daemon, dhcpd, chronyd, nmbd and cupsd are listening
> on UDP sockets (most of them on internal network).
>
> But I have no idea what application is causing the messages.
I'm guessing that its ICMP errors containing UDP fragments.
Could you add a WARN_ON(1) to ipv4_get_l4proto() in
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c to verify
this?
next prev parent reply other threads:[~2007-09-01 5:28 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-08-21 10:56 ipv4_get_l4proto: Frag of proto 17 Meelis Roos
2007-08-30 7:08 ` Patrick McHardy
2007-08-30 13:04 ` Meelis Roos
2007-09-01 5:28 ` Patrick McHardy [this message]
2007-09-01 15:04 ` Meelis Roos
2007-09-01 16:19 ` Patrick McHardy
-- strict thread matches above, loose matches on Subject: below --
2007-09-02 7:55 Prakash Punnoor
2007-09-02 21:05 ` Luca
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=46D8F87A.1080604@trash.net \
--to=kaber@trash.net \
--cc=mroos@linux.ee \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.