From: Grant Taylor <gtaylor@riverviewtech.net>
To: Mail List - Netfilter <netfilter@vger.kernel.org>
Subject: Re: Site-specific filter rules problem
Date: Tue, 27 May 2008 09:29:02 -0500 [thread overview]
Message-ID: <483C1AAE.1010709@riverviewtech.net> (raw)
In-Reply-To: <1211702139.7164.22.camel@u804mbr>
On 05/25/08 02:55, Mark Baker wrote:
> I have packet captures from connections to this site, with and
> without firewall rules installed. I don't see anything that should
> be blocked based on these rules - the only thing odd is that when the
> problem occurs I get a ton of retransmissions from the server.
> Another oddity in both cases is that virtually every packet coming
> from the server is fragmented; but from what I've read, connection
> tracking (which is running on this machine) should completely
> reassemble fragmented packets before delivery to the filter table.
> Still, could fragmentation be the problem?
Based on the retransmissions, it sounds like something is expecting to
get something through and have it acknowledged that is not.
I'd look at what is being re-transmitted and see if it needs to get
through and / or if there is an unacknowledged reply that is being blocked.
Grant. . . .
next prev parent reply other threads:[~2008-05-27 14:29 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-05-25 7:55 Site-specific filter rules problem Mark Baker
2008-05-27 14:29 ` Grant Taylor [this message]
2008-05-29 5:02 ` Mark Baker
2008-05-29 5:23 ` Grant Taylor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=483C1AAE.1010709@riverviewtech.net \
--to=gtaylor@riverviewtech.net \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox