Strange log entries (again)

Strange log entries (again)

[Patrick Petermair]

Hi!

I have found the following log entry in my firewall log (I'm running RedHat 
7.3 with iptables for firewalling and masquerading):

Jul  8 22:25:11 wormhole kernel: IN=ppp0 OUT= MAC= SRC=207.171.169.16 
DST=213.225.41.145 LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=21031 DF PROTO=TCP 
SPT=80 DPT=42111 WINDOW=8760 RES=0x00 ACK RST URGP=0

The thing is that this is an answer from a website (SPT=80) I surfed on 
(www.amazon.de) - but my forward chain should detect it as an existing 
connection and let it through:

#echo "   FWD: Allow all connections OUT and only existing and related ones 
IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED 
-j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG

I can access this website and everything works fine, I just don't understand 
why a few packets get blocked at my firewall and not routed through! Is this 
a bug in the conntrack module?
Btw: What do the ACK and RST flags mean? Where can I find some infos about the 
existing flags?

Thnx so far!
Patrick

-- 
http://www.petermair.com

Re: Strange log entries (again)

[Antony Stone]

On Monday 08 July 2002 9:43 pm, Patrick Petermair wrote:

> Hi!
>
> I have found the following log entry in my firewall log (I'm running RedHat
> 7.3 with iptables for firewalling and masquerading):
>
> Jul  8 22:25:11 wormhole kernel: IN=ppp0 OUT= MAC= SRC=207.171.169.16
> DST=213.225.41.145 LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=21031 DF PROTO=TCP
> SPT=80 DPT=42111 WINDOW=8760 RES=0x00 ACK RST URGP=0
>
> The thing is that this is an answer from a website (SPT=80) I surfed on
> (www.amazon.de) - but my forward chain should detect it as an existing
> connection and let it through:

This is an ACK RST packet, so it's quite likely that the connection tracking 
has already deleted the connection from the conntrack table (when it got the 
previous RST packet), therefore when this packet turns up, it no longer 
belongs to an ESTABLISHED connection.

Don't worry about it.

 

Antony.

Re: Strange log entries (again)

[Patrick Petermair]

Am Montag, 8. Juli 2002 22:58 schrieb Antony Stone:
> On Monday 08 July 2002 9:43 pm, Patrick Petermair wrote:
> > Jul  8 22:25:11 wormhole kernel: IN=ppp0 OUT= MAC= SRC=207.171.169.16
> > DST=213.225.41.145 LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=21031 DF PROTO=TCP
> > SPT=80 DPT=42111 WINDOW=8760 RES=0x00 ACK RST URGP=0
>
> This is an ACK RST packet, so it's quite likely that the connection
> tracking has already deleted the connection from the conntrack table (when
> it got the previous RST packet), therefore when this packet turns up, it no
> longer belongs to an ESTABLISHED connection.
>
> Don't worry about it.

Mhmm, am I the only one getting these entries in my logs?
I'm thinking of putting a rule just before the logging rule to drop those 
packets because they are useless information for the logs.

Is this due to a misconfiguration of the destination 
webserver/router/firewall?

Thnx so far...
Patrick

-- 
http://www.petermair.com

Re: Strange log entries (again)

[Antony Stone]

On Monday 08 July 2002 9:43 pm, Patrick Petermair wrote:

> Btw: What do the ACK and RST flags mean? Where can I find some infos about
> the existing flags?

http://www.faqs.org/rfcs/rfc793.html

Esp. figure 6 p 23

 

Antony.