nf_ct_ftp: dropping packet

nf_ct_ftp: dropping packet

[Marian Marinov]

[-- Attachment #1: Type: Text/Plain, Size: 945 bytes --]

Hello,
I'm working for a fairly large shared hosting provider. Recently we decided to 
upgrade the kernel of our servers to 2.6.33. However, during the testing phase 
we started to see these messages in the logs:

Mar 18 07:52:26 serv01 kernel: nf_ct_ftp: dropping packetIN= OUT=eth0 
SRC=212.212.212.12 DST=204.16.203.11 LEN=53 TOS=0x10 PREC=0x00 TTL=64 ID=21858 
DF PROTO=TCP SPT=21 DPT=47282 SEQ=1836474396 ACK=1448911219 WINDOW=23 RES=0x00 
ACK PSH FIN URGP=0

We don't have iptables LOG rules, this is generated directly from the kernel.

212.212... is not a real IP I have substituted it.

Our kernel is 2.6.33 with GRsecurity patch.

We don't have any problems with the ftp service, however the messages in the 
log files are annoying. 

Can someone tell me what can cause those? 

My current thoughts are to remove the printk from the kernel. But is there a 
better solution?

-- 
Best regards,
Marian Marinov

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: nf_ct_ftp: dropping packet

[Patrick McHardy]

Marian Marinov wrote:
> Hello,
> I'm working for a fairly large shared hosting provider. Recently we decided to 
> upgrade the kernel of our servers to 2.6.33. However, during the testing phase 
> we started to see these messages in the logs:
>
> Mar 18 07:52:26 serv01 kernel: nf_ct_ftp: dropping packetIN= OUT=eth0 
> SRC=212.212.212.12 DST=204.16.203.11 LEN=53 TOS=0x10 PREC=0x00 TTL=64 ID=21858 
> DF PROTO=TCP SPT=21 DPT=47282 SEQ=1836474396 ACK=1448911219 WINDOW=23 RES=0x00 
> ACK PSH FIN URGP=0
>
> We don't have iptables LOG rules, this is generated directly from the kernel.
>
> 212.212... is not a real IP I have substituted it.
>
> Our kernel is 2.6.33 with GRsecurity patch.
>
> We don't have any problems with the ftp service, however the messages in the 
> log files are annoying. 
>
> Can someone tell me what can cause those?
The helper decided to drop a packet. This is usually cause by partial
FTP command matches, which can't be handled.
>  
>
> My current thoughts are to remove the printk from the kernel. But is there a 
> better solution?
>   
If you don't use logging, unload the ipt_LOG module.

Re: nf_ct_ftp: dropping packet

[Marian Marinov]

[-- Attachment #1: Type: Text/Plain, Size: 2839 bytes --]

On Friday 19 March 2010 16:37:14 Patrick McHardy wrote:
> Marian Marinov wrote:
> > Hello,
> > I'm working for a fairly large shared hosting provider. Recently we
> > decided to upgrade the kernel of our servers to 2.6.33. However, during
> > the testing phase we started to see these messages in the logs:
> >
> > Mar 18 07:52:26 serv01 kernel: nf_ct_ftp: dropping packetIN= OUT=eth0
> > SRC=212.212.212.12 DST=204.16.203.11 LEN=53 TOS=0x10 PREC=0x00 TTL=64
> > ID=21858 DF PROTO=TCP SPT=21 DPT=47282 SEQ=1836474396 ACK=1448911219
> > WINDOW=23 RES=0x00 ACK PSH FIN URGP=0
> >
> > We don't have iptables LOG rules, this is generated directly from the
> > kernel.
> >
> > 212.212... is not a real IP I have substituted it.
> >
> > Our kernel is 2.6.33 with GRsecurity patch.
> >
> > We don't have any problems with the ftp service, however the messages in
> > the log files are annoying.
> >
> > Can someone tell me what can cause those?
> 
> The helper decided to drop a packet. This is usually cause by partial
> FTP command matches, which can't be handled.
> 
> > My current thoughts are to remove the printk from the kernel. But is
> > there a better solution?
> 
> If you don't use logging, unload the ipt_LOG module.

It is not loaded, and I still see those messages... 
Here is the list of loaded modules:

root@milano175:~# lsmod
Module                  Size  Used by
ipv6                  233580  22
nf_nat_ftp              1356  0
nf_conntrack_ftp        4590  1 nf_nat_ftp
xt_length                868  1
xt_state                 974  52
xt_pkttype               720  4
xt_dscp                 1185  1
xt_multiport            1914  3
xt_owner                 786  6
ipt_REDIRECT             817  1
iptable_nat             2815  1
nf_nat                 13129  3 nf_nat_ftp,ipt_REDIRECT,iptable_nat
nf_conntrack_ipv4       8957  55 iptable_nat,nf_nat
nf_conntrack           53525  6 
nf_nat_ftp,nf_conntrack_ftp,xt_state,iptable_nat,nf_nat,nf_conntrack_ipv4
nf_defrag_ipv4           965  1 nf_conntrack_ipv4
iptable_mangle          1365  0
iptable_raw              947  0
dm_mirror              10278  0
dm_region_hash          8145  1 dm_mirror
dm_log                  7119  2 dm_mirror,dm_region_hash
dm_multipath           12463  0
power_meter             7442  0
sr_mod                 10557  0
tg3                    97760  0
cdrom                  32827  1 sr_mod
iTCO_wdt                8164  0
i3200_edac              2574  0
iTCO_vendor_support     2251  1 iTCO_wdt
uhci_hcd               16215  0


> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

-- 
Best regards,
Marian Marinov

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: nf_ct_ftp: dropping packet

[Patrick McHardy]

Marian Marinov wrote:
> On Friday 19 March 2010 16:37:14 Patrick McHardy wrote:
>   
>> Marian Marinov wrote:
>>     
>>> Hello,
>>> I'm working for a fairly large shared hosting provider. Recently we
>>> decided to upgrade the kernel of our servers to 2.6.33. However, during
>>> the testing phase we started to see these messages in the logs:
>>>
>>> Mar 18 07:52:26 serv01 kernel: nf_ct_ftp: dropping packetIN= OUT=eth0
>>> SRC=212.212.212.12 DST=204.16.203.11 LEN=53 TOS=0x10 PREC=0x00 TTL=64
>>> ID=21858 DF PROTO=TCP SPT=21 DPT=47282 SEQ=1836474396 ACK=1448911219
>>> WINDOW=23 RES=0x00 ACK PSH FIN URGP=0
>>>
>>> We don't have iptables LOG rules, this is generated directly from the
>>> kernel.
>>>
>>> 212.212... is not a real IP I have substituted it.
>>>
>>> Our kernel is 2.6.33 with GRsecurity patch.
>>>
>>> We don't have any problems with the ftp service, however the messages in
>>> the log files are annoying.
>>>
>>> Can someone tell me what can cause those?
>>>       
>> The helper decided to drop a packet. This is usually cause by partial
>> FTP command matches, which can't be handled.
>>
>>     
>>> My current thoughts are to remove the printk from the kernel. But is
>>> there a better solution?
>>>       
>> If you don't use logging, unload the ipt_LOG module.
>>     
>
> It is not loaded, and I still see those messages... 

In that case you must have linked it statically. Without it, there are
no messages.