On Wed, 2011-07-06 at 06:48 -0700, Tom Eastep wrote: > On Tue, 2011-07-05 at 21:05 -0700, Tom Eastep wrote: > > > On Jul 5, 2011, at 5:46 PM, Ricardo Rios wrote: > > > When i connect from Box-2 to any ftp, works all ok, but when i try to > > > connect from Box-1 i get this on /var/log/firewall > > > > > > 21:37:40 insert-master kernel: [832161.057782] nf_ct_ftp: dropping > > > packetIN=eth4 OUT= MAC=00:0a:cd:1a:d1:95:00:22:6b:be:3c:41:08:00 > > > SRC=66.199.187.46 DST=192.168.41.1 LEN=102 TOS=0x00 PREC=0x00 TTL=45 > > > ID=30239 DF PROTO=TCP SPT=21 DPT=50892 SEQ=698644583 ACK=3438176321 > > > WINDOW=46 RES=0x00 ACK PSH URGP=0 OPT (0101080A932DFE0231935CF7) MARK=0x1 > > > > > Obviously, the URL is http://www.shorewall.net/FTP.html > > The message you are seeing is not generated by Shorewall but is rather > generated by the FTP connection tracking helper in the kernel. I don't > find it in the kernel source I have here locally (2.6.32).
I've done a bit of looking around on the Web and it appears that this message has replaced the traditional 'partial' message mentioned in Shorewall FTP HOWTO. It means that a message (probably a PASV REPLY) is not complete because it was split between two packets. I've seen this problem connecting to a particular FTP server, but I've never seen it on all servers from a local network. Makes me think that the ftp helper on that firewall is *not* working correctly. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ All of the data generated in your IT infrastructure is seriously valuable. Why? It contains a definitive record of application performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. And common sense. http://p.sf.net/sfu/splunk-d2d-c2
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
