Rene van Hoek wrote:
Hello,
I am using IPF v4.1.28 on FreeBSD7. The firewall is working stable and
does what is is supposed to do. So no problems there.
The following however, I don't expect: In the ipfstat -t output I see
the same connections (source-ip, port <--> destination-ip, port) twice.
For example (part of output ipfstat -t):
Source IP Destination IP ST PR #pkts
#bytes ttl
80.60.81.93,1363 195.86.22.59,587 B/6 tcp 173
202746 0:13
80.57.132.26,60464 195.86.22.53,22 4/4 tcp 2393 147824
119:59:59
80.60.81.93,1363 195.86.22.59,587 B/6 tcp 88
101445 0:13
80.57.132.26,60477 195.86.22.59,22 4/4 tcp 1077 64400
119:59:47 (*)
77.162.155.20,49808 195.86.22.50,80 4/4 tcp 203 54140
119:59:17
77.162.155.20,49807 195.86.22.50,80 4/4 tcp 173 45966
119:59:16
80.57.132.26,56603 195.86.22.50,80 4/4 tcp 429
45716 96:09:25
78.171.174.130,1675 195.86.22.54,80 4/4 tcp 145
45292 90:04:42
85.147.196.239,54166 195.86.22.52,80 4/4 tcp 95 34286
119:57:45
83.82.139.218,51157 195.86.22.50,80 B/4 tcp 153
33210 0:12
80.57.132.26,60477 195.86.22.59,22 4/4 tcp 540 32296
119:59:47 (*)
Marked with * is twice.
The output of ipfstat is:
IP states added:
1862533 TCP
523994 UDP
0 ICMP
49403681 hits
9612162 misses
0 bucket full
0 maximum rule references
0 maximum
0 no memory
1231 bkts in use
2496 active
523940 expired
1860091 closed
State logging enabled
State table bucket statistics:
1231 in use
49% hash efficiency
1.89% bucket usage
0 minimal length
4 maximal length
2.028 average length
TCP Entries per state
0 1 2 3 4 5 6 7 8 9 10 11
0 0 24 0 1017 556 12 0 10 0 332 491
In this output I see that 1231 buckets are in use. Does that mean that
there are 1231 connections for which state-informattion is kept in memory?
No. It is hash table terminology.
I see that there are 2496 'active'. Does that mean that there are 2496
hashes which point too the 1231 connections? Is that the (1231/2496) =
49% hash efficiency?
No and yes.
So does ipfstat -t takes the hash-entries and shows the information
found in the buckets? Does that explain why the output of ipfstat -t
shows connections twice?
Is this behavior by design or should I worry about it?
hmmm... so it could be the mechanism used to get state entries out
of the kernel is walking through a very active list and that it changes
between the first and the n-th, displaying an entry twice.
Darren
