From: Patrick McHardy <kaber@trash.net>
To: Marian Marinov <mm@yuhu.biz>
Cc: netfilter@vger.kernel.org
Subject: Re: nf_ct_ftp: dropping packet
Date: Fri, 19 Mar 2010 16:24:59 +0100 [thread overview]
Message-ID: <4BA3974B.2060404@trash.net> (raw)
In-Reply-To: <201003191643.04191.mm@yuhu.biz>
Marian Marinov wrote:
> On Friday 19 March 2010 16:37:14 Patrick McHardy wrote:
>
>> Marian Marinov wrote:
>>
>>> Hello,
>>> I'm working for a fairly large shared hosting provider. Recently we
>>> decided to upgrade the kernel of our servers to 2.6.33. However, during
>>> the testing phase we started to see these messages in the logs:
>>>
>>> Mar 18 07:52:26 serv01 kernel: nf_ct_ftp: dropping packetIN= OUT=eth0
>>> SRC=212.212.212.12 DST=204.16.203.11 LEN=53 TOS=0x10 PREC=0x00 TTL=64
>>> ID=21858 DF PROTO=TCP SPT=21 DPT=47282 SEQ=1836474396 ACK=1448911219
>>> WINDOW=23 RES=0x00 ACK PSH FIN URGP=0
>>>
>>> We don't have iptables LOG rules, this is generated directly from the
>>> kernel.
>>>
>>> 212.212... is not a real IP I have substituted it.
>>>
>>> Our kernel is 2.6.33 with GRsecurity patch.
>>>
>>> We don't have any problems with the ftp service, however the messages in
>>> the log files are annoying.
>>>
>>> Can someone tell me what can cause those?
>>>
>> The helper decided to drop a packet. This is usually cause by partial
>> FTP command matches, which can't be handled.
>>
>>
>>> My current thoughts are to remove the printk from the kernel. But is
>>> there a better solution?
>>>
>> If you don't use logging, unload the ipt_LOG module.
>>
>
> It is not loaded, and I still see those messages...
In that case you must have linked it statically. Without it, there are
no messages.
prev parent reply other threads:[~2010-03-19 15:24 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-03-19 11:09 nf_ct_ftp: dropping packet Marian Marinov
2010-03-19 14:37 ` Patrick McHardy
2010-03-19 14:43 ` Marian Marinov
2010-03-19 15:24 ` Patrick McHardy [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4BA3974B.2060404@trash.net \
--to=kaber@trash.net \
--cc=mm@yuhu.biz \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.