Re: Every other char with LOG netfilter output (bug?)

All of lore.kernel.org
 help / color / mirror / Atom feed

From: Patrick McHardy <kaber@trash.net>
To: "Dâniel Fraga" <fragabr@gmail.com>
Cc: netfilter-devel@vger.kernel.org,
	"Pablo Neira Ayuso" <pablo@netfilter.org>,
	"Ilpo Järvinen" <ilpo.jarvinen@helsinki.fi>
Subject: Re: Every other char with LOG netfilter output (bug?)
Date: Mon, 03 Nov 2008 13:42:32 +0100	[thread overview]
Message-ID: <490EF1B8.2060308@trash.net> (raw)
In-Reply-To: <490a671a.0687460a.3af5.40a2@mx.google.com>

Dâniel Fraga wrote:
> On Thu, 30 Oct 2008 08:15:14 +0100
> Patrick McHardy <kaber@trash.net> wrote:
> 
>> One thing you need is to specify the amount of bytes you want transfered
>> to userspace:
>>
>> iptables ... -j NFLOG --nflog-range 65535
> 
> 	Another one (now with --nflog-range 65535 as requested):
> 
> 	1) using LOG:
> 
> Oct 30 23:14:34 tux vmunix: :d0:87:60:0SC6.3.310DT121812LN4 O=x0PE=x0TL4 D0POOTPST8 P=94 IDW0RS00 C S RP0
> Oct 30 23:14:34 tux vmunix: 6DO NU:I=t0OT A=01:3e:79:01:fe:b2:80 R=3267.9 S=9.6.. E=0TS00 RC00 T=4I= RT=C P=0DT585WNO= E=x0AKRTUG= 
> 
> 	2) using NFLOG (syslog emul):
> 
> Oct 30 23:14:34 tux DROP INPUT:  IN=eth0 OUT= MAC=00:18:f3:e4:47:9f:00:1d:0f:e8:7b:26:08:00 SRC=63.236.73.190 DST=192.168.1.2 LEN=40 TOS=00 PREC=0x00 TTL=44 ID=0 PROTO=TCP SPT=80 DPT=59845 SEQ=0 ACK=2739255566 WINDOW=0 ACK RST URGP=0 MARK=0 
> 
> Oct 30 23:14:34 tux DROP INPUT:  IN=eth0 OUT= MAC=00:18:f3:e4:47:9f:00:1d:0f:e8:7b:26:08:00 SRC=63.236.73.190 DST=192.168.1.2 LEN=40 TOS=00 PREC=0x00 TTL=44 ID=0 PROTO=TCP SPT=80 DPT=59845 SEQ=0 ACK=2739255566 WINDOW=0 ACK RST URGP=0 MARK=0 
> 
> Oct 30 23:14:34 tux DROP INPUT:  IN=eth0 OUT= MAC=00:18:f3:e4:47:9f:00:1d:0f:e8:7b:26:08:00 SRC=63.236.73.190 DST=192.168.1.2 LEN=40 TOS=00 PREC=0x00 TTL=44 ID=0 PROTO=TCP SPT=80 DPT=59845 SEQ=0 ACK=2739255566 WINDOW=0 ACK RST URGP=0 MARK=0 
> 
> Oct 30 23:14:34 tux DROP INPUT:  IN=eth0 OUT= MAC=00:18:f3:e4:47:9f:00:1d:0f:e8:7b:26:08:00 SRC=63.236.73.190 DST=192.168.1.2 LEN=40 TOS=00 PREC=0x00 TTL=44 ID=0 PROTO=TCP SPT=80 DPT=59845 SEQ=0 ACK=2739255567 WINDOW=0 ACK RST URGP=0 MARK=0 
> 
> 	It's interesting to note that NFLOG always give the double of the entries of the "wrong" LOG entries.
> 
> 	3) and the attached pcap log file.
> 
> 	I hope that it will give you some hint. Thanks!

It doesn't explain why the LOG output is corrupted, but it seems
the hanging connections are caused by RST packets that are considered
INVALID.

Please enable conntrack debugging by executing:

echo 255 >/proc/sys/net/netfilter/nf_conntrack_log_invalid

so we can see why these packets are considered invalid.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

next prev parent reply	other threads:[~2008-11-03 12:42 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-10-28 17:09 Every other char with LOG netfilter output (bug?) Dâniel Fraga
2008-10-28 17:40 ` Patrick McHardy
2008-10-28 17:57   ` Dâniel Fraga
2008-10-28 18:13     ` Patrick McHardy
2008-10-28 18:50       ` Jan Engelhardt
2008-10-28 18:53         ` Patrick McHardy
2008-10-28 19:16       ` Dâniel Fraga
2008-10-30  5:50       ` Dâniel Fraga
2008-10-30  7:15         ` Patrick McHardy
2008-10-30 15:02           ` Pablo Neira Ayuso
2008-10-30 23:23           ` Dâniel Fraga
2008-10-31  2:01           ` Dâniel Fraga
2008-11-03 12:42             ` Patrick McHardy [this message]
2008-11-03 15:41               ` Dâniel Fraga

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=490EF1B8.2060308@trash.net \
    --to=kaber@trash.net \
    --cc=fragabr@gmail.com \
    --cc=ilpo.jarvinen@helsinki.fi \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.