All of lore.kernel.org
 help / color / mirror / Atom feed
From: Michele Petrazzo - Unipex <michele.petrazzo@unipex.it>
To: Jan Engelhardt <jengelh@medozas.de>
Cc: netfilter@vger.kernel.org
Subject: Re: strange log on gateway inside []
Date: Thu, 29 Jul 2010 11:18:59 +0200	[thread overview]
Message-ID: <4C514783.2000603@unipex.it> (raw)
In-Reply-To: <alpine.LSU.2.01.1007291051570.10386@obet.zrqbmnf.qr>

Jan Engelhardt ha scritto:
>> My output chain:
>> *filter
>> :OUTPUT DROP [4831251:620928037]
>> -A OUTPUT -o lo -j ACCEPT
>> -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
>> -A OUTPUT -j LOG --log-prefix "Firewall DROPOUT- "
>
> So what's left is INVALID packets.
>

First, thanks.
Seem that a rule that drop the INVALID packets to the trick. But... drop 
or reject the invalid packets?

>> The question. Why I see this log and why my fw want to talk with external and,
>> the last, why the kernel double log talk and one is inside the brackets  [ ] ?
>
> Because those are the contents of the ICMP packet. See the RFC.

Append also with tcp, no only icmp.
P.s. Have you a rfc number?

And the last, have you also an rfc that explain why and where invalid 
come from?

Thanks

  reply	other threads:[~2010-07-29  9:18 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-07-29  8:38 strange log on gateway inside [] Michele Petrazzo - Unipex
2010-07-29  8:52 ` Jan Engelhardt
2010-07-29  9:18   ` Michele Petrazzo - Unipex [this message]
2010-07-29  9:49     ` Jan Engelhardt
2010-07-29  9:20 ` Pascal Hambourg
2010-07-30 10:41 ` Michele Petrazzo - Unipex
2010-07-30 10:48   ` Richard Horton
2010-07-30 11:12   ` Jan Engelhardt

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4C514783.2000603@unipex.it \
    --to=michele.petrazzo@unipex.it \
    --cc=jengelh@medozas.de \
    --cc=netfilter@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.