* Why is this traffic dropped?
@ 2008-06-18 17:11 Douglas Rabe
2008-06-18 18:03 ` Gáspár Lajos
0 siblings, 1 reply; 7+ messages in thread
From: Douglas Rabe @ 2008-06-18 17:11 UTC (permalink / raw)
To: netfilter
Greetings,
I dont understand why this traffic is dropped?
Jun 18 17:03:39 iahabs1 kernel: IN_DROP: IN=eth0 OUT= MAC=00:1c:23:ca:ec:1d:00:1b:53:87:68:c0:08:00 SRC=10.192.130.104 DST=192.168.51.1 LEN=40 TOS=0x00 PREC=0x00 TTL=119 ID=5563 DF PROTO=TCP SPT=35557 DPT=80 WINDOW=65149 RES=0x00 ACK FIN URGP=0
iahabs1:~# iptables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
337M 82G ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
8747 559K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
19M 2104M ACCEPT 0 -- lo * 0.0.0.0/0 0.0.0.0/0
14686 450K ACCEPT 2 -- eth0 * 0.0.0.0/0 224.0.0.0/8
26049 2169K ACCEPT 0 -- eth1 * 0.0.0.0/0 0.0.0.0/0
37255 1790K ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 80,30001
9068K 602M ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 3210
0 0 ACCEPT tcp -- eth3 * 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 80,30001
91 3640 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `IN_DROP: '
91 3640 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 0 level 4 prefix `FWD_INVAL: '
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `FWD_DROP: '
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
323M 271G ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
19M 2104M ACCEPT 0 -- * lo 0.0.0.0/0 0.0.0.0/0
9792 313K ACCEPT 2 -- * eth0 0.0.0.0/0 224.0.0.0/8
1020 69064 ACCEPT 0 -- * eth1 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW udp dpts:33435:33535
1 60 ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 22,30035
60639 4487K ACCEPT udp -- * eth0 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 53
12 4332 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `OUT_DROP: '
12 4332 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
iahabs1:~#
--
Douglas Rabe
drabe@sensis.com
315-234-7995
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Why is this traffic dropped?
2008-06-18 17:11 Why is this traffic dropped? Douglas Rabe
@ 2008-06-18 18:03 ` Gáspár Lajos
2008-06-18 18:37 ` Jan Engelhardt
0 siblings, 1 reply; 7+ messages in thread
From: Gáspár Lajos @ 2008-06-18 18:03 UTC (permalink / raw)
To: drabe; +Cc: netfilter
Douglas Rabe írta:
> Greetings,
>
> I dont understand why this traffic is dropped?
>
> Jun 18 17:03:39 iahabs1 kernel: IN_DROP: IN=eth0 OUT= MAC=00:1c:23:ca:ec:1d:00:1b:53:87:68:c0:08:00 SRC=10.192.130.104 DST=192.168.51.1 LEN=40 TOS=0x00 PREC=0x00 TTL=119 ID=5563 DF PROTO=TCP SPT=35557 DPT=80 WINDOW=65149 RES=0x00 ACK FIN URGP=0
>
>
Because it is a FIN packet... = ! (NEW,RELATED or ESTABLISHED) but
INVALID !!!
> iahabs1:~# iptables -nvL
> Chain INPUT (policy DROP 0 packets, 0 bytes)
> pkts bytes target prot opt in out source destination
> 337M 82G ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
> 8747 559K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW icmp type 8
> 19M 2104M ACCEPT 0 -- lo * 0.0.0.0/0 0.0.0.0/0
> 14686 450K ACCEPT 2 -- eth0 * 0.0.0.0/0 224.0.0.0/8
> 26049 2169K ACCEPT 0 -- eth1 * 0.0.0.0/0 0.0.0.0/0
> 37255 1790K ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 80,30001
> 9068K 602M ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 3210
> 0 0 ACCEPT tcp -- eth3 * 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 80,30001
> 91 3640 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `IN_DROP: '
> 91 3640 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
>
>
Swifty
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Why is this traffic dropped?
2008-06-18 18:03 ` Gáspár Lajos
@ 2008-06-18 18:37 ` Jan Engelhardt
2008-06-18 19:20 ` Douglas Rabe
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Jan Engelhardt @ 2008-06-18 18:37 UTC (permalink / raw)
To: Gáspár Lajos; +Cc: drabe, netfilter
On Wednesday 2008-06-18 20:03, Gáspár Lajos wrote:
> Douglas Rabe írta:
>> Greetings,
>>
>> I dont understand why this traffic is dropped?
>>
>> Jun 18 17:03:39 iahabs1 kernel: IN_DROP: IN=eth0 OUT=
>> MAC=00:1c:23:ca:ec:1d:00:1b:53:87:68:c0:08:00 SRC=10.192.130.104
>> DST=192.168.51.1 LEN=40 TOS=0x00 PREC=0x00 TTL=119 ID=5563 DF PROTO=TCP
>> SPT=35557 DPT=80 WINDOW=65149 RES=0x00 ACK FIN URGP=0
>
> Because it is a FIN packet... = ! (NEW,RELATED or ESTABLISHED) but
> INVALID !!!
Seriously, FIN packets should not be dropped, otherwise a connection
is lurking around until it times out.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Why is this traffic dropped?
2008-06-18 18:37 ` Jan Engelhardt
@ 2008-06-18 19:20 ` Douglas Rabe
2008-06-18 19:41 ` Benedikt Gollatz
2008-06-18 20:21 ` Jozsef Kadlecsik
2 siblings, 0 replies; 7+ messages in thread
From: Douglas Rabe @ 2008-06-18 19:20 UTC (permalink / raw)
To: netfilter; +Cc: Gáspár Lajos, Rabe Douglas
>On Wednesday 2008-06-18 20:03, Gáspár Lajos wrote:
>
>> Douglas Rabe wrote:
>>> Greetings,
>>>
>>> I dont understand why this traffic is dropped?
>>>
>>> Jun 18 17:03:39 iahabs1 kernel: IN_DROP: IN=eth0 OUT=
>>> MAC=00:1c:23:ca:ec:1d:00:1b:53:87:68:c0:08:00 SRC=10.192.130.104
>>> DST=192.168.51.1 LEN=40 TOS=0x00 PREC=0x00 TTL=119 ID=5563 DF PROTO=TCP
>>> SPT=35557 DPT=80 WINDOW=65149 RES=0x00 ACK FIN URGP=0
>>
>> Because it is a FIN packet... = ! (NEW,RELATED or ESTABLISHED) but
>> INVALID !!!
>
>Seriously, FIN packets should not be dropped, otherwise a connection
>is lurking around until it times out.
So, how do I fix my firewall not to drop these FIN packets?
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
There is no --state FIN is there?
--
Douglas Rabe
drabe@sensis.com
315-234-7995
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Why is this traffic dropped?
2008-06-18 18:37 ` Jan Engelhardt
2008-06-18 19:20 ` Douglas Rabe
@ 2008-06-18 19:41 ` Benedikt Gollatz
2008-06-18 20:21 ` Jozsef Kadlecsik
2 siblings, 0 replies; 7+ messages in thread
From: Benedikt Gollatz @ 2008-06-18 19:41 UTC (permalink / raw)
To: netfilter
On Wednesday 18 June 2008 20:37:27 Jan Engelhardt wrote:
> >> Jun 18 17:03:39 iahabs1 kernel: IN_DROP: IN=eth0 OUT=
> >> MAC=00:1c:23:ca:ec:1d:00:1b:53:87:68:c0:08:00 SRC=10.192.130.104
> >> DST=192.168.51.1 LEN=40 TOS=0x00 PREC=0x00 TTL=119 ID=5563 DF PROTO=TCP
> >> SPT=35557 DPT=80 WINDOW=65149 RES=0x00 ACK FIN URGP=0
> >
> > Because it is a FIN packet... = ! (NEW,RELATED or ESTABLISHED) but
> > INVALID !!!
>
> Seriously, FIN packets should not be dropped, otherwise a connection
> is lurking around until it times out.
Some port scanners use FIN-Packets ("FIN scan", "Xmas scan") to check whether
a RST is sent back (service listening) or the packet is just ignored (no
service there). In this case, incoming FIN packets won't belong to a
connection, are therefore INVALID, and can be dropped, if you think that
blocking this port scans enhances your security.
FIN packets should not be INVALID if there's an entry in the state table for
the connection they belong to anyway, or am I missing something?
Benedikt
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Why is this traffic dropped?
2008-06-18 18:37 ` Jan Engelhardt
2008-06-18 19:20 ` Douglas Rabe
2008-06-18 19:41 ` Benedikt Gollatz
@ 2008-06-18 20:21 ` Jozsef Kadlecsik
2008-06-18 20:39 ` Jan Engelhardt
2 siblings, 1 reply; 7+ messages in thread
From: Jozsef Kadlecsik @ 2008-06-18 20:21 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: Gáspár Lajos, drabe, netfilter
[-- Attachment #1: Type: TEXT/PLAIN, Size: 1290 bytes --]
On Wed, 18 Jun 2008, Jan Engelhardt wrote:
> On Wednesday 2008-06-18 20:03, Gáspár Lajos wrote:
>
> > Douglas Rabe írta:
> >>
> >> I dont understand why this traffic is dropped?
> >>
> >> Jun 18 17:03:39 iahabs1 kernel: IN_DROP: IN=eth0 OUT=
> >> MAC=00:1c:23:ca:ec:1d:00:1b:53:87:68:c0:08:00 SRC=10.192.130.104
> >> DST=192.168.51.1 LEN=40 TOS=0x00 PREC=0x00 TTL=119 ID=5563 DF PROTO=TCP
> >> SPT=35557 DPT=80 WINDOW=65149 RES=0x00 ACK FIN URGP=0
> >
> > Because it is a FIN packet... = ! (NEW,RELATED or ESTABLISHED) but
> > INVALID !!!
>
> Seriously, FIN packets should not be dropped, otherwise a connection
> is lurking around until it times out.
Absolutely true. FIN packets which are OK according to conntrack are
marked as ESTABLISHED (or RELATED).
Without knowing the kernel version, one can only assume that it's the last
packet of the stream which arrived too late: conntrack already deleted the
the corresponding conntrack entry and therefore it could be categorized as
INVALID only.
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Why is this traffic dropped?
2008-06-18 20:21 ` Jozsef Kadlecsik
@ 2008-06-18 20:39 ` Jan Engelhardt
0 siblings, 0 replies; 7+ messages in thread
From: Jan Engelhardt @ 2008-06-18 20:39 UTC (permalink / raw)
To: Jozsef Kadlecsik; +Cc: Gáspár Lajos, drabe, netfilter
On Wednesday 2008-06-18 22:21, Jozsef Kadlecsik wrote:
>> Seriously, FIN packets should not be dropped, otherwise a connection
>> is lurking around until it times out.
>
>Absolutely true. FIN packets which are OK according to conntrack are
>marked as ESTABLISHED (or RELATED).
No, only connections that would have been NEW can be RELATED
(i.e. RELATED is an augmented NEW state), all other packets
are ESTABLISHED only, be it related or not.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2008-06-18 20:39 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-06-18 17:11 Why is this traffic dropped? Douglas Rabe
2008-06-18 18:03 ` Gáspár Lajos
2008-06-18 18:37 ` Jan Engelhardt
2008-06-18 19:20 ` Douglas Rabe
2008-06-18 19:41 ` Benedikt Gollatz
2008-06-18 20:21 ` Jozsef Kadlecsik
2008-06-18 20:39 ` Jan Engelhardt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox