* What does "NAT: dropping untracked packet" mean?
@ 2001-02-01 12:38 Nils Rennebarth
2001-02-01 14:17 ` Matthias Andree
2001-02-01 15:09 ` James Stevenson
0 siblings, 2 replies; 6+ messages in thread
From: Nils Rennebarth @ 2001-02-01 12:38 UTC (permalink / raw)
To: Linux Kernel List
[-- Attachment #1: Type: text/plain, Size: 997 bytes --]
Since enabling (but not yet using) firewalling in the 2.4.1 kernel, my log
gets clobbered with messages like:
Feb 1 12:58:56 obelix kernel: NAT: 0 dropping untracked packet ce767600 1 129.69.22.21 -> 224.0.0.2
Feb 1 12:59:01 obelix kernel: NAT: 0 dropping untracked packet ce767480 1 129.69.22.21 -> 224.0.0.2
Feb 1 12:59:04 obelix kernel: NAT: 0 dropping untracked packet ce767d80 1 129.69.22.21 -> 224.0.0.2
Feb 1 13:00:44 obelix kernel: NAT: 0 dropping untracked packet ce767600 1 129.69.22.51 -> 224.0.0.2
Feb 1 13:00:47 obelix kernel: NAT: 0 dropping untracked packet ce767600 1 129.69.22.51 -> 224.0.0.2
Feb 1 13:00:50 obelix kernel: NAT: 0 dropping untracked packet ce767b40 1 129.69.22.51 -> 224.0.0.2
The IP Adresses belong to Windows 98 computers. What does the message mean,
and what could I do to stop them?
Nils
--
*New* *New* *New* - on shellac records
Windows HE - see top 10 reasons to downgrade on
Historical Edition http://www.microsoft.com/windowshe
[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: What does "NAT: dropping untracked packet" mean?
2001-02-01 12:38 What does "NAT: dropping untracked packet" mean? Nils Rennebarth
@ 2001-02-01 14:17 ` Matthias Andree
2001-02-01 23:19 ` dmeyer
2001-02-01 15:09 ` James Stevenson
1 sibling, 1 reply; 6+ messages in thread
From: Matthias Andree @ 2001-02-01 14:17 UTC (permalink / raw)
To: Linux Kernel List
On Thu, 01 Feb 2001, Nils Rennebarth wrote:
> Since enabling (but not yet using) firewalling in the 2.4.1 kernel, my log
> gets clobbered with messages like:
>
> Feb 1 12:58:56 obelix kernel: NAT: 0 dropping untracked packet ce767600 1 129.69.22.21 -> 224.0.0.2
>
> The IP Adresses belong to Windows 98 computers. What does the message mean,
> and what could I do to stop them?
It means that your box drops multicast administrative packets on the
floor.
--
Matthias Andree
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: What does "NAT: dropping untracked packet" mean?
2001-02-01 14:17 ` Matthias Andree
@ 2001-02-01 23:19 ` dmeyer
2001-02-01 23:45 ` Daniel Pittman
2001-02-01 23:46 ` Magnus Erixzon
0 siblings, 2 replies; 6+ messages in thread
From: dmeyer @ 2001-02-01 23:19 UTC (permalink / raw)
To: linux-kernel
In article <20010201151717.D5706@emma1.emma.line.org> you write:
> On Thu, 01 Feb 2001, Nils Rennebarth wrote:
> > Feb 1 12:58:56 obelix kernel: NAT: 0 dropping untracked packet
> ce767600 1 129.69.22.21 -> 224.0.0.2
>
> It means that your box drops multicast administrative packets on the
> floor.
I'm getting the occasional
Feb 1 13:17:08 yendi kernel: NAT: 0 dropping untracked packet
c3ea4da0 1 146.188.249.73 -> 209.220.232.240
syslog message. What exactly does it mean? 146.188.249.73 isn't my
machine at all, and 209.220.232.240 is my firewall. I assume I'm
dropping someone's packets on the floor, but what can cause a packet
to get dropped like that?
--
Dave Meyer
dmeyer@dmeyer.net
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: What does "NAT: dropping untracked packet" mean?
2001-02-01 23:19 ` dmeyer
@ 2001-02-01 23:45 ` Daniel Pittman
2001-02-01 23:46 ` Magnus Erixzon
1 sibling, 0 replies; 6+ messages in thread
From: Daniel Pittman @ 2001-02-01 23:45 UTC (permalink / raw)
To: dmeyer; +Cc: linux-kernel
dmeyer <dmeyer@dmeyer.net> writes:
>
> In article <20010201151717.D5706@emma1.emma.line.org> you write:
>> On Thu, 01 Feb 2001, Nils Rennebarth wrote:
>> > Feb 1 12:58:56 obelix kernel: NAT: 0 dropping untracked packet
>> ce767600 1 129.69.22.21 -> 224.0.0.2
>>
>> It means that your box drops multicast administrative packets on the
>> floor.
>
> I'm getting the occasional
>
> Feb 1 13:17:08 yendi kernel: NAT: 0 dropping untracked packet c3ea4da0
> 1 146.188.249.73 -> 209.220.232.240
>
> syslog message. What exactly does it mean? 146.188.249.73 isn't my
> machine at all, and 209.220.232.240 is my firewall. I assume I'm
> dropping someone's packets on the floor, but what can cause a packet
> to get dropped like that?
The one big thing I know of that causes these messages is a
long-standing bug in the FreeBSD and OpenBSD (and presumably NetBSD, I
don't know about that one, though) network stacks.
When sending an ICMP host unreachable response to a DF packet, some of
the packet was byte-swapped.
The bytes were *only* in the segment of the original IP packet appended
to the ICMP message for identification purposes.
Under normal conditions this packet works fine with Linux. The
connection is killed, all is fine.
When running netfilter and connection tracking, netfilter uses these
byte-swapped fields to associate the ICMP message with the original TCP
or UDP packets.
Because the fields are out-of-order, this match fails. netfilter then
drops the packet on the floor and generates the 'untracked packet'
message.
FreeBSD have fixes their network stack not that long ago. I believe that
their 5.0 release corrects the bug, but I am not sure of that. Check
with them if you really care.
I don't believe that OpenBSD have corrected this problem at this stage
but, again, I have not checked recently. Check with them if you really
care.
This bug is *only* triggered when the packet has DF set. Normal packets
don't trigger that particular buggy code path.
Daniel
--
The truth knocks on the door and you say, 'Go away, I'm looking for
the truth,' and so it goes away. Puzzling...
-- Robert Pirsig
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: What does "NAT: dropping untracked packet" mean?
2001-02-01 23:19 ` dmeyer
2001-02-01 23:45 ` Daniel Pittman
@ 2001-02-01 23:46 ` Magnus Erixzon
1 sibling, 0 replies; 6+ messages in thread
From: Magnus Erixzon @ 2001-02-01 23:46 UTC (permalink / raw)
To: dmeyer; +Cc: linux-kernel
This is explained in the netfilter FAQ.
http://netfilter.kernelnotes.org/netfilter-faq-3.html#ss3.1
/ Magnus
On Thu, 1 Feb 2001 dmeyer@dmeyer.net wrote:
> I'm getting the occasional
>
> Feb 1 13:17:08 yendi kernel: NAT: 0 dropping untracked packet
> c3ea4da0 1 146.188.249.73 -> 209.220.232.240
>
> syslog message. What exactly does it mean? 146.188.249.73 isn't my
> machine at all, and 209.220.232.240 is my firewall. I assume I'm
> dropping someone's packets on the floor, but what can cause a packet
> to get dropped like that?
>
> --
> Dave Meyer
> dmeyer@dmeyer.net
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: What does "NAT: dropping untracked packet" mean?
2001-02-01 12:38 What does "NAT: dropping untracked packet" mean? Nils Rennebarth
2001-02-01 14:17 ` Matthias Andree
@ 2001-02-01 15:09 ` James Stevenson
1 sibling, 0 replies; 6+ messages in thread
From: James Stevenson @ 2001-02-01 15:09 UTC (permalink / raw)
To: nils; +Cc: linux-kernel
Hi
do the messages apear when the windows machines a booting ?
i would tend to think that the kernel cannot handle the NET on
IGMP packets so its printting a message about it
the packets do look like they are goign to a multicast address
>
>Feb 1 12:58:56 obelix kernel: NAT: 0 dropping untracked packet ce767600 1 129.69.22.21 -> 224.0.0.2
>Feb 1 12:59:01 obelix kernel: NAT: 0 dropping untracked packet ce767480 1 129.69.22.21 -> 224.0.0.2
>Feb 1 12:59:04 obelix kernel: NAT: 0 dropping untracked packet ce767d80 1 129.69.22.21 -> 224.0.0.2
>Feb 1 13:00:44 obelix kernel: NAT: 0 dropping untracked packet ce767600 1 129.69.22.51 -> 224.0.0.2
>Feb 1 13:00:47 obelix kernel: NAT: 0 dropping untracked packet ce767600 1 129.69.22.51 -> 224.0.0.2
>Feb 1 13:00:50 obelix kernel: NAT: 0 dropping untracked packet ce767b40 1 129.69.22.51 -> 224.0.0.2
>
--
---------------------------------------------
Check Out: http://stev.org
E-Mail: mistral@stev.org
3:00pm up 16 days, 22:21, 4 users, load average: 1.37, 1.38, 1.25
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2001-02-01 23:46 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2001-02-01 12:38 What does "NAT: dropping untracked packet" mean? Nils Rennebarth
2001-02-01 14:17 ` Matthias Andree
2001-02-01 23:19 ` dmeyer
2001-02-01 23:45 ` Daniel Pittman
2001-02-01 23:46 ` Magnus Erixzon
2001-02-01 15:09 ` James Stevenson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox