Re: Iptables find invalid packets

[Dimitri GOURDON <dgourdon@itool.com>]

I will try but don't believe it :

I've reproduce the same behavior in my lab with only 1 client... so... I 
try  ;)

Dimitri

Bernhard Bock a écrit :
> Hi Dimitri,
>
> Dimitri GOURDON wrote:
>> A lot of TCP packets with FIN or RST flags (all I think) from clients 
>> are dropped by Iptables as state INVALID. The consequence is that I 
>> have a lot of connection in FIN_WAIT state (shown by netstat) on the 
>> 2 web servers...
> [...]
>> Is someone can help me ???
>
> Sounds a bit like the problem I've asked about a few days ago. Try to 
> increase the hashsize of nf_conntrack. My INVALID packets vanished 
> after this (at least as long as I wasn't using conntrackd for stateful 
> failover).
>
> best regards
> Bernhard