* What does this mean?
@ 2003-02-27 15:06 Raymond Leach
2003-02-27 15:48 ` Maciej Soltysiak
0 siblings, 1 reply; 6+ messages in thread
From: Raymond Leach @ 2003-02-27 15:06 UTC (permalink / raw)
To: Netfilter Mailing List
Hi
I see this in my firewall log:
Feb 27 16:51:19 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.67 DST=68.84.228.144 LEN=60 TOS=0x00 PREC=0x00 TTL=63
ID=64368 DF PROTO=TCP SPT=54767 DPT=0 WINDOW=5840 RES=0x00 CWR ECE SYN
URGP=0
What is DPT=0? I've never heard of using port 0 ...
What is CWR ECE SYN? Are they TCP flags? If so, what is CWR ECE ?
Ray
--
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: What does this mean?
2003-02-27 15:06 What does this mean? Raymond Leach
@ 2003-02-27 15:48 ` Maciej Soltysiak
2003-03-05 17:02 ` Alexander W. Janssen
0 siblings, 1 reply; 6+ messages in thread
From: Maciej Soltysiak @ 2003-02-27 15:48 UTC (permalink / raw)
To: Raymond Leach; +Cc: Netfilter Mailing List
> I see this in my firewall log:
> Feb 27 16:51:19 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
> SRC=10.0.0.67 DST=68.84.228.144 LEN=60 TOS=0x00 PREC=0x00 TTL=63
> ID=64368 DF PROTO=TCP SPT=54767 DPT=0 WINDOW=5840 RES=0x00 CWR ECE SYN
> URGP=0
>
> What is DPT=0? I've never heard of using port 0 ...
No services there, this packet is certainly invalid. Some OS's respond to
them with tcp rst, some just drop them.
> What is CWR ECE SYN? Are they TCP flags? If so, what is CWR ECE ?
Yes they are TCP flags, CWR & ECE are ECN extensions to the TCP header.
Read RFC 3168.
Note, some routers outthere are not ECN aware and violate RFC 3168 by
dropping these packets. This causes interoperability problems, which
should be resolved by vendors.
> Ray
Maciej
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: What does this mean?
2003-02-27 15:48 ` Maciej Soltysiak
@ 2003-03-05 17:02 ` Alexander W. Janssen
0 siblings, 0 replies; 6+ messages in thread
From: Alexander W. Janssen @ 2003-03-05 17:02 UTC (permalink / raw)
To: Netfilter Mailinglist
[-- Attachment #1: Type: text/plain, Size: 791 bytes --]
On Thu, Feb 27, 2003 at 04:48:30PM +0100, Maciej Soltysiak wrote:
> Note, some routers outthere are not ECN aware and violate RFC 3168 by
> dropping these packets. This causes interoperability problems, which
> should be resolved by vendors.
At http://urchin.earth.li/cgi-bin/ecn.pl?output=ip is a list with routers with
are known to violate ECN. There is even a perl-script around wich uses the
--remove-ecn feature of the ECN target to create rules based on that list of
IP-addresses. Quite nice, since it sorts out the problem locally - but not in
a global sense. Call it self-defense.
> > Ray
> Maciej
Alex
--
"Mr Data, when I said 'Fire at Will', I didn't mean for you to be so literal."
Instructions for use of this post: Insert tounge in cheek. Read as normal.
[-- Attachment #2: Type: application/pgp-signature, Size: 248 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* What does this mean ?
@ 2003-03-19 9:51 Frederic Gobin
2003-03-19 11:05 ` Raymond Leach
0 siblings, 1 reply; 6+ messages in thread
From: Frederic Gobin @ 2003-03-19 9:51 UTC (permalink / raw)
To: netfilter
Hi there everybody,
I have one question :
Each time I look into my firewall logs, I see many dropped packets
that match this pattern :
Protocol : TCP
Source port : 80
Dest port : 1024-65535
Flags : ACK FIN
Where are those packets comming from ?
Thanks for reading and Thanks for each answer I get ...
Frederic Gobin
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: What does this mean ?
2003-03-19 9:51 What does this mean ? Frederic Gobin
@ 2003-03-19 11:05 ` Raymond Leach
2003-03-19 11:16 ` Frederic Gobin
0 siblings, 1 reply; 6+ messages in thread
From: Raymond Leach @ 2003-03-19 11:05 UTC (permalink / raw)
To: Netfilter Mailing List
[-- Attachment #1: Type: text/plain, Size: 1337 bytes --]
That would be IE clients browsing the web. IE is the only browser I've
found that does this.
On Wed, 2003-03-19 at 11:51, Frederic Gobin wrote:
> Hi there everybody,
>
> I have one question :
>
> Each time I look into my firewall logs, I see many dropped packets
> that match this pattern :
>
> Protocol : TCP
> Source port : 80
> Dest port : 1024-65535
> Flags : ACK FIN
>
> Where are those packets comming from ?
>
> Thanks for reading and Thanks for each answer I get ...
>
> Frederic Gobin
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
( Raymond Leach )
) Knowledge Factory (
( )
) Tel: +27 11 445 8100 (
( Fax: +27 11 445 8101 )
) (
( http://www.knowledgefactory.co.za/ )
) http://www.saptg.co.za/ (
( http://www.mapnet.co.za/ )
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
o o
o o
.--. .--.
| o_o| |o_o |
| \_:| |:_/ |
/ / \\ // \ \
( | |) (| | )
/`\_ _/'\ /'\_ _/`\
\___)=(___/ \___)=(___/
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: What does this mean ?
2003-03-19 11:05 ` Raymond Leach
@ 2003-03-19 11:16 ` Frederic Gobin
0 siblings, 0 replies; 6+ messages in thread
From: Frederic Gobin @ 2003-03-19 11:16 UTC (permalink / raw)
To: netfilter
So I can add a rule to drop thos packets without having any problems ?
(That could clear the logs a bit ;-))
Frederic Gobin
Am Mittwoch, 19.03.03 um 12:05 Uhr schrieb Raymond Leach:
> That would be IE clients browsing the web. IE is the only browser I've
> found that does this.
>
> On Wed, 2003-03-19 at 11:51, Frederic Gobin wrote:
>> Hi there everybody,
>>
>> I have one question :
>>
>> Each time I look into my firewall logs, I see many dropped packets
>> that match this pattern :
>>
>> Protocol : TCP
>> Source port : 80
>> Dest port : 1024-65535
>> Flags : ACK FIN
>>
>> Where are those packets comming from ?
>>
>> Thanks for reading and Thanks for each answer I get ...
>>
>> Frederic Gobin
> --
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ( Raymond Leach )
> ) Knowledge Factory (
> ( )
> ) Tel: +27 11 445 8100 (
> ( Fax: +27 11 445 8101 )
> ) (
> ( http://www.knowledgefactory.co.za/ )
> ) http://www.saptg.co.za/ (
> ( http://www.mapnet.co.za/ )
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> o o
> o o
> .--. .--.
> | o_o| |o_o |
> | \_:| |:_/ |
> / / \\ // \ \
> ( | |) (| | )
> /`\_ _/'\ /'\_ _/`\
> \___)=(___/ \___)=(___/
>
> <signature.asc>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-03-19 11:16 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-02-27 15:06 What does this mean? Raymond Leach
2003-02-27 15:48 ` Maciej Soltysiak
2003-03-05 17:02 ` Alexander W. Janssen
-- strict thread matches above, loose matches on Subject: below --
2003-03-19 9:51 What does this mean ? Frederic Gobin
2003-03-19 11:05 ` Raymond Leach
2003-03-19 11:16 ` Frederic Gobin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox