We've got a few servers where we see similar behaviour (running 3.4.31 on
solaris 9)
Feb 1 14:25:03 ns1.ht ipmon[92]: [ID 702911 local0.warning] 14:25:03.523152
hme0 @0:24 b xxx.xxx.xxx.248,35931 -> yyy.yyy.yyy.50,8443 PR tcp len 20 52 -AF
IN
Feb 1 14:25:05 ns1.ht ipmon[92]: [ID 702911 local0.warning] 14:25:05.562480
hme0 @0:24 b xxx.xxx.xxx.248,35931 -> yyy.yyy.yyy.50,8443 PR tcp len 20 191
-AFP IN
Feb 1 14:25:12 ns1.ht ipmon[92]: [ID 702911 local0.warning] 14:25:12.602694
hme0 @0:24 b xxx.xxx.xxx.248,35931 -> yyy.yyy.yyy.50,8443 PR tcp len 20 191
-AFP IN
Feb 1 14:25:26 ns1.ht ipmon[92]: [ID 702911 local0.warning] 14:25:26.685533
hme0 @0:24 b xxx.xxx.xxx.248,35931 -> yyy.yyy.yyy.50,8443 PR tcp len 20 191
-AFP IN
Feb 1 14:25:54 ns1.ht ipmon[92]: [ID 702911 local0.warning] 14:25:54.842143
hme0 @0:24 b xxx.xxx.xxx.248,35931 -> yyy.yyy.yyy.50,8443 PR tcp len 20 191
-AFP IN
Feb 1 14:25:58 ns1.ht ipmon[92]: [ID 702911 local0.warning] 14:25:58.584418
hme0 @0:24 b xxx.xxx.xxx.248,35931 -> yyy.yyy.yyy.50,8443 PR tcp len 20 40 -R IN
Feb 1 14:26:36 ns1.ht ipmon[92]: [ID 702911 local0.warning] 14:26:36.705447
hme0 @0:24 b 211.126.199.141,35642 -> 64.59.168.50,49153 PR udp len 20 38 IN
and with
pass in quick proto tcp from xxx.xxx.xxx.0/23 to any port = 8443 flags S keep
state keep frags
in the rules file.
state table stats on said box:
IP states added:
20323 TCP
19414788 UDP
0 ICMP
45920495 hits
39668302 misses
237297 maximum
0 no memory
2930 bkts in use
4013 active
19411029 expired
20069 closed
IP states added:
20323 TCP
19414788 UDP
0 ICMP
45920495 hits
39668302 misses
237297 maximum
0 no memory
2930 bkts in use
4013 active
19411029 expired
20069 closed
thanks in advance,
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Jim Sandoz
Sent: January 27, 2006 8:37 AM
To: Barb, Duane
Cc: [email protected]
Subject: Re: Dropped Packets - Help please!
Barb, Duane wrote:
> I'm getting dropped packets:
>
> [ID 702911 local0.warning] 08:45:14.146313 bge0 @0:2 b x.x.x.x,30404 ->
> x.x.x.x,443 PR tcp len 20 40 -AR IN
duane,
this is a blocked packet, not a dropped packet.
it is arriving at your external interface and being blocked.
note, the line above indicates that the ACK+RST flags are set.
my best guess is that this tuple was once in the state table,
but the connection is already torn down, (i.e., ipf's state
table has deleted the entry), and this packet is thus bouncing
off of the firewall and being logged as a blocked packet.
in other words, it is a packet not associated with a current
state entry, and also not one that initiates a state entry
by the following rule (since the flags don't match up):
> pass in quick on bge0 proto tcp from any to x.y.z.122/32 port = 443
> flags S keep state keep frags
and therefore it is blocked.
seeing the above log entry, assuming you are not having other
issues, is no cause for alarm. more than likely it is due to
the interaction of the web server/client connection keepalive
mechanisms and ipf's state table expiry times.
jim
