From: Chris Brenton <cbrenton@chrisbrenton.org>
To: Christof Nyffenegger <cnyf@yahoo.de>
Cc: Jim Carter <jimc@math.ucla.edu>, netfilter@lists.netfilter.org
Subject: Re: unexpected behaviour...?
Date: Tue, 02 Sep 2003 15:59:35 -0400 [thread overview]
Message-ID: <3F54F6A7.8020004@chrisbrenton.org> (raw)
In-Reply-To: 20030828113329.32071.qmail@web21404.mail.yahoo.com
Christof Nyffenegger wrote:
>
>>Oh, I didn't understand the configuration. Hmmm again. I would really
>>expect the http and ssh connections to behave the same.
>
> Yep, thats the point. but they don't.
I have not followed this whole thread, so if this idea has been
suggested already please feel free to /dev/null this.
My experience has been that most SSH clients issue a keep alive while
HTTP does not. If your accept rule is based on IP and port number only
(in other words, you are not doing a --tcp-flags ALL SYN), its possible
that the outbound ACK from the client is recreating the session in the
state table.
Easy way to check this would be to write your SSH rule with the above
switch. If SSH starts acting like HTTP (no longer re-creates the state
table entry) then you know this is it.
HTH,
C
next prev parent reply other threads:[~2003-09-02 19:59 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-08-22 22:42 unexpected behaviour...? Christof Nyffenegger
2003-08-25 21:29 ` Jim Carter
2003-08-26 19:48 ` Christof Nyffenegger
2003-08-27 3:52 ` Jim Carter
2003-08-28 11:33 ` Christof Nyffenegger
2003-08-28 16:29 ` Jim Carter
2003-09-02 19:59 ` Chris Brenton [this message]
2003-09-02 20:26 ` Ralf Spenneberg
-- strict thread matches above, loose matches on Subject: below --
2003-09-08 21:24 Christof Nyffenegger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3F54F6A7.8020004@chrisbrenton.org \
--to=cbrenton@chrisbrenton.org \
--cc=cnyf@yahoo.de \
--cc=jimc@math.ucla.edu \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox