From: "Gilad Benjamini" <gilad.benjamini@gmail.com>
To: netfilter@vger.kernel.org
Subject: Ping in ESTABLISHED
Date: Sat, 6 Dec 2008 10:25:52 -0800 [thread overview]
Message-ID: <493ac3bf.14098e0a.4085.ffffcfe1@mx.google.com> (raw)
I have a situation where a continuous ping, expected to create a new
connection each time, turns into a single connection in ESTABLISHED state
Here are the details:
- iptables runs on a bridge
- The bridge connects eth1 and eth2
- The iptables rules (minimized for the sake of this post)
-A FORWARD -p icmp -m physdev --physdev-in eth1 --physdev-is-bridged -j
ACCEPT
-A FORWARD -p icmp -m state --state ESTABLISHED -j ACCEPT
-A FORWARD -p icmp -m state --state NEW -j ACCEPT
-A FORWARD -j ACCEPT
- A machine located on the eth2 network constantly sends a ping to a machine
located in eth1 network
- "iptables -L -v" shows the counters growing on rules #1 and #3. This is
expected.
- However, at some point, the counters start increasing on rule #2, and stop
increasing on rule #3. This can happen after 200 pings, 400, or even 3000 in
one overnight test.
Any idea what's going on ?
next reply other threads:[~2008-12-06 18:25 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-12-06 18:25 Gilad Benjamini [this message]
2008-12-07 10:56 ` Ping in ESTABLISHED Christoph Paasch
2008-12-07 16:42 ` Gilad Benjamini
2008-12-07 17:10 ` Christoph Paasch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=493ac3bf.14098e0a.4085.ffffcfe1@mx.google.com \
--to=gilad.benjamini@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox