Hi all.

I am having a strange situation with IPF. I am trying to log all passed packets (the log is passed to a third-party stats program for graphical analysis).

The problem is that I see many packets apparently being duplicated in the ipmon.log. The packet enters the firewall from the internal interface OK, but it appears to be transmitted out to the internet twice. Conversely, there are often multiple inbound packets from the internet which become just one on the internal interface.

See these two examples (beware of line-wrap):
1) Internet to LAN
09:30:00.508378 2x ed1 @0:21 P,443 ->,1277 PR tcp len 20 296 -AP K-S IN
09:30:00.509446 hdlc5 @0:21 P,443 ->,1277 PR tcp len 20 296 -AP K-S OUT

2) LAN to internet ( is my NAT address)
09:30:00.616102 hdlc5 @0:21 P,1277 ->,443 PR tcp len 20 40 -A K-S IN
09:30:00.616188 ed1 @0:21 P,1277 ->,443 PR tcp len 20 40 -A K-S OUT
09:30:00.616275 ed1 @0:21 P,1277 ->,443 PR tcp len 20 40 -A K-S OUT

I don't believe the packets are ACTUALLY being resent twice, because the stats I have under MRTG indicate matching traffic volumes on the corresponding interfaces. I suspect the issue has something to do with how IPF and IPMON log the packets. But I'm not sure.

Any help in understanding/fixing this would be greatly appreciated.

Patrick O'Reilly. _______________________________________________
[EMAIL PROTECTED] mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to