Hi, Since upgrading from 5.1.12 to 5.2.0 on the machine that I build firewall rulesets for my shorewall-lite-running-router, I have seen a massive increase in RST and FIN packets being logged such as:
Jun 15 15:30:02 gw kernel: [895825.983756] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=26372 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:02 gw kernel: [895826.007873] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=26386 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:02 gw kernel: [895826.031463] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=26418 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:01 gw kernel: [895825.211953] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=26386 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:01 gw kernel: [895825.235647] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=26372 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:01 gw kernel: [895825.259243] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=26418 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:01 gw kernel: [895825.282820] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=26425 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:02 gw kernel: [895825.465867] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=26386 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:02 gw kernel: [895825.489637] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=26372 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:02 gw kernel: [895825.983756] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=26372 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:02 gw kernel: [895826.007873] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=26386 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Jun 15 15:30:02 gw kernel: [895826.031463] Shorewall:net2fw:DROP:IN=eth0.2 OUT= MAC=... SRC=72.143.208.198 DST=my.router.address LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=26418 DPT=443 WINDOW=1517 RES=0x00 ACK FIN URGP=0 MARK=0x100 Surely these are just "straggler" packets that come in once a TCP conntrack session has been closed, so nothing terribly out of the ordinary there. But why are they being logged all of a sudden, as of the 5.2.0 upgrade? Any ideas? Cheers, b.
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
