Linux Netfilter discussions
 help / color / mirror / Atom feed
From: "Gáspár Lajos" <swifty@freemail.hu>
To: drabe@sensis.com
Cc: netfilter@vger.kernel.org
Subject: Re: Why is this traffic dropped?
Date: Wed, 18 Jun 2008 20:03:16 +0200	[thread overview]
Message-ID: <48594DE4.9070006@freemail.hu> (raw)
In-Reply-To: <200806181711.m5IHBbkX023710@doug.ats.sensis.com>

Douglas Rabe írta:
> Greetings,
>
> I dont understand why this traffic is dropped?
>
> Jun 18 17:03:39 iahabs1 kernel: IN_DROP: IN=eth0 OUT= MAC=00:1c:23:ca:ec:1d:00:1b:53:87:68:c0:08:00 SRC=10.192.130.104 DST=192.168.51.1 LEN=40 TOS=0x00 PREC=0x00 TTL=119 ID=5563 DF PROTO=TCP SPT=35557 DPT=80 WINDOW=65149 RES=0x00 ACK FIN URGP=0 
>
>   
Because it is a FIN packet... =  ! (NEW,RELATED or ESTABLISHED) but 
INVALID !!!
> iahabs1:~# iptables -nvL
> Chain INPUT (policy DROP 0 packets, 0 bytes)
>  pkts bytes target     prot opt in     out     source               destination         
>  337M   82G ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
>  8747  559K ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW icmp type 8 
>   19M 2104M ACCEPT     0    --  lo     *       0.0.0.0/0            0.0.0.0/0           
> 14686  450K ACCEPT     2    --  eth0   *       0.0.0.0/0            224.0.0.0/8         
> 26049 2169K ACCEPT     0    --  eth1   *       0.0.0.0/0            0.0.0.0/0           
> 37255 1790K ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           state NEW multiport dports 80,30001 
> 9068K  602M ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           state NEW multiport dports 3210 
>     0     0 ACCEPT     tcp  --  eth3   *       0.0.0.0/0            0.0.0.0/0           state NEW multiport dports 80,30001 
>    91  3640 LOG        0    --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `IN_DROP: ' 
>    91  3640 DROP       0    --  *      *       0.0.0.0/0            0.0.0.0/0           
>
>   
Swifty


  reply	other threads:[~2008-06-18 18:03 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-06-18 17:11 Why is this traffic dropped? Douglas Rabe
2008-06-18 18:03 ` Gáspár Lajos [this message]
2008-06-18 18:37   ` Jan Engelhardt
2008-06-18 19:20     ` Douglas Rabe
2008-06-18 19:41     ` Benedikt Gollatz
2008-06-18 20:21     ` Jozsef Kadlecsik
2008-06-18 20:39       ` Jan Engelhardt

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=48594DE4.9070006@freemail.hu \
    --to=swifty@freemail.hu \
    --cc=drabe@sensis.com \
    --cc=netfilter@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox