From: Marco Innocenti <m.innocenti@cineca.it>
To: netfilter-devel@vger.kernel.org
Subject: Packet marked wrongly as INVALID?
Date: Thu, 1 Jul 2010 11:12:42 +0200 (MEST) [thread overview]
Message-ID: <4C2C5C0A.3070109@cineca.it> (raw)
[-- Attachment #1: Type: text/plain, Size: 2722 bytes --]
Hi,
on a couple of production server I get routinely some packet which
should be marked as NEW are marked as INVALID and I'm unable to
understand why or to reproduce the problem in a testing environment.
I use distribution kernel (SUSE 2.6.16.60-0.58.1-smp and Debian
2.6.26-2-amd64) on intel (64 bit) but I could try a recent kernel if
need arise.
Jul 1 09:14:44 miur10 kernel: INPUT-INVALIDIN=bond0 OUT=
MAC=00:22:19:bb:85:7b:00:0b:fc:fe:1b:01:08:00 SRC=130.186.5.204
DST=10.253.0.11 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=47760 DF PROTO=TCP
SPT=53816 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
Jul 1 09:16:18 miur10 kernel: INPUT-INVALIDIN=bond0 OUT=
MAC=00:22:19:bb:85:7b:00:0b:fc:fe:1b:01:08:00 SRC=130.186.5.204
DST=10.253.0.11 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=13606 DF PROTO=TCP
SPT=54446 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
Jul 1 09:16:34 miur10 kernel: INPUT-INVALIDIN=bond0 OUT=
MAC=00:22:19:bb:85:7b:00:0b:fc:fe:1b:01:08:00 SRC=130.186.5.204
DST=10.253.0.11 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=15917 DF PROTO=TCP
SPT=54694 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
Jul 1 09:16:55 miur10 kernel: INPUT-INVALIDIN=bond0 OUT=
MAC=00:22:19:bb:85:7b:00:0b:fc:fe:1b:01:08:00 SRC=130.186.5.204
DST=10.253.0.11 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=22772 DF PROTO=TCP
SPT=54863 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
miur10:/ # iptables -L -n -v | head -n 4
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
33M 21G ACCEPT all -- bond1 * 0.0.0.0/0
0.0.0.0/0
245K 11M LOG all -- * * 0.0.0.0/0
0.0.0.0/0 state INVALID LOG flags 0 level 4 prefix
`INPUT-INVALID'
In the attached file INVALID packets are only logged (no DROP). If I
DROP the packet they are retrasmitted and marked again as INVALID:
Jul 1 11:03:12 miur10 kernel: INPUT-INVALIDIN=bond0 OUT=
MAC=00:22:19:bb:85:7b:00:0b:fc:fe:1b:01:08:00 SRC=130.186.5.204
DST=10.253.0.11 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=5926 DF PROTO=TCP
SPT=53260 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
Jul 1 11:03:15 miur10 kernel: INPUT-INVALIDIN=bond0 OUT=
MAC=00:22:19:bb:85:7b:00:0b:fc:fe:1b:01:08:00 SRC=130.186.5.204
DST=10.253.0.11 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=5927 DF PROTO=TCP
SPT=53260 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
--
**********************************************************************
Marco Innocenti Dipartimento Sistemi E Tecnologie
CINECA phone:+39 0516171553 / fax:+39 0516132198
Via Magnanelli 6/3 e-mail: innocenti@cineca.it
40033 Casalecchio di Reno Bologna (Italia)
**********************************************************************
[-- Attachment #2: tcpdump.pcap.bz2 --]
[-- Type: application/x-bzip, Size: 27649 bytes --]
next reply other threads:[~2010-07-01 9:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-07-01 9:12 Marco Innocenti [this message]
2010-07-02 7:55 ` Packet marked wrongly as INVALID? Patrick McHardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4C2C5C0A.3070109@cineca.it \
--to=m.innocenti@cineca.it \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.