packets rejected as invalid, why?

packets rejected as invalid, why?

[Olaf Zaplinski]

Hello all,

since Dec. 1st I see 60 rejected packets from well known and "good" 
SMTP hosts:

Dec  2 12:12:02 binky kernel: [873572.327219] iptables-INVALID IN=eth0 
OUT= MAC=00:f1:70:00:58:f0:fc:fb:fb:2d:55:48:08:00 SRC=213.165.67.104 
DST=109.75.188.214 LEN=40 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP 
SPT=25 DPT=37022 SEQ=3171195917 ACK=0 WINDOW=0 RES=0x00 RST URGP=0

Why are these logged and rejected?

The rules:

$IPTABLES -A INPUT -m conntrack --ctstate INVALID -m limit \
--limit 3/s -j LOG --log-prefix="iptables-INVALID " \
--log-tcp-sequence --log-tcp-options

$IPTABLES -A INPUT -m conntrack --ctstate INVALID -j DROP

I think this packet was part of the TCP closing handshake, so it should 
have been ESTABLISHED and not INVALID. Am I wrong?

Olaf

Re: packets rejected as invalid, why?

[Pascal Hambourg]

Hello,

Olaf Zaplinski a écrit :
> 
> since Dec. 1st I see 60 rejected packets from well known and "good" 
> SMTP hosts:
> 
> Dec  2 12:12:02 binky kernel: [873572.327219] iptables-INVALID IN=eth0 
> OUT= MAC=00:f1:70:00:58:f0:fc:fb:fb:2d:55:48:08:00 SRC=213.165.67.104 
> DST=109.75.188.214 LEN=40 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP 
> SPT=25 DPT=37022 SEQ=3171195917 ACK=0 WINDOW=0 RES=0x00 RST URGP=0
> 
> Why are these logged and rejected?

Because your rules below say so.

> The rules:
> 
> $IPTABLES -A INPUT -m conntrack --ctstate INVALID -m limit \
> --limit 3/s -j LOG --log-prefix="iptables-INVALID " \
> --log-tcp-sequence --log-tcp-options
> 
> $IPTABLES -A INPUT -m conntrack --ctstate INVALID -j DROP
> 
> I think this packet was part of the TCP closing handshake, so it should 
> have been ESTABLISHED and not INVALID. Am I wrong?

RST is not part of the normal TCP closing handshake (FIN+ACK, FIN+ACK,
ACK). My guess is that this packet is related to an old connection which
is considered already closed by conntrack.