On 27 Jan 2015, at 08:49, Aristedes Maniatis <[email protected]> wrote: > > On 27/01/2015 6:46pm, Dimitry Andric wrote: >> On 27 Jan 2015, at 07:25, Aristedes Maniatis <[email protected]> wrote: >>> >>> I have been unable to find much documentation about the counter called >>> "state-mismatch". I notice it going up on my firewall (FreeBSD 10.1) but >>> only at a slow rate (maybe at around 1 per minute). >>> >>> What is the significance of this value? Is it indicative of dropped states >>> (and I should be increasing the state timeout)? >> >> It's not really documented in our pfctl(8) manpage, but the OpenBSD version >> does >> mention it: >> >> state-mismatch >> packet was associated with a state entry, but sequence numbers did >> not >> match >> >> So maybe something is dropping packets, making holes in the sequence >> numbers? Or >> maybe somebody is trying something sneaky? :) >> >> -Dimitry > > Ah, thanks for that. Maybe you could add that doc to the FreeBSD man page. > Could it simply be a packet loss issue where a packet is lost and the next > packet arrives out of order?
Well, that is just a likely cause. If you let tcpdump run for a while, you might be able to spot it, in e.g. Wireshark? -Dimitry
signature.asc
Description: Message signed with OpenPGP using GPGMail
