Max Laier wrote: > On Tuesday 01 August 2006 16:29, Frank Steinborn wrote: > > That's it. It's not possible, and i'm really frustrated for days now. > > What is actually borked here? Let's have a look on the pflog0, what's > > dropping: > > > > 15:26:35.983709 rule 1/0(match): block in on gif0: > > 2001:1638:17ad::3.53 > 2001:1638:17ad::3.59761: tcp 40 [bad hdr > > length 4 - too short, < 20] > > > > Hmm. Bad hdr lenght? What's up here? If i change the rule > > This really just is an artefact from a too short snaplen. Use -s 1500 and > you > get rid of it. > > The strange thing, however, is that this is the reply *from* port 53. So > this > means the initial SYN got through alright. Can you check if a state has been > created (pfctl -vss) for that connection, please. I suspect that it has and > the problem would be that the reply doesn't match the state - for what ever > reason. Please check if there is a state and let me know - thanks.
Hello Max, a state is created, yes: self tcp 2001:1638:17ad::3[53] <- 2001:1638:17ad::3[62810] SYN_SENT:ESTABLISHED [342525613 + 65536](+2469478632) wscale 1 [3355548528 + 65537](+82545723) wscale 1 [1845438366 + 4880](+1776883750) [3423429433 + 65535](+3331864375) age 00:37:53, expires in 00:00:59, 2204:15980 pkts, 107106:2269450 bytes age 01:22:57, expires in 00:01:00, 5472:42944 pkts, 324485:6199453 bytes age 02:00:22, expires in 00:00:59, 11249:53620 pkts, 967458:7637333 bytes Strange thing :-( Thanks, Frank _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "[EMAIL PROTECTED]"
