From owner-freebsd-pf@FreeBSD.ORG Tue Jan 27 08:07:31 2015 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id EE04CF95 for ; Tue, 27 Jan 2015 08:07:31 +0000 (UTC) Received: from tensor.andric.com (tensor.andric.com [87.251.56.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "tensor.andric.com", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id AB413FEA for ; Tue, 27 Jan 2015 08:07:31 +0000 (UTC) Received: from [IPv6:2001:7b8:3a7::c917:66ee:a8b8:73e5] (unknown [IPv6:2001:7b8:3a7:0:c917:66ee:a8b8:73e5]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by tensor.andric.com (Postfix) with ESMTPSA id D103D5C2E; Tue, 27 Jan 2015 09:07:22 +0100 (CET) Subject: Re: meaning of State-mismatch Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\)) Content-Type: multipart/signed; boundary="Apple-Mail=_68BC1EE8-3796-4317-8254-5A246704A3F3"; protocol="application/pgp-signature"; micalg=pgp-sha1 X-Pgp-Agent: GPGMail 2.5b4 From: Dimitry Andric In-Reply-To: <54C74303.1070601@ish.com.au> Date: Tue, 27 Jan 2015 09:07:18 +0100 Message-Id: <8A242C55-A2D7-49C2-A0CC-AFB1E447C494@FreeBSD.org> References: <54C72F63.8040908@ish.com.au> <54C74303.1070601@ish.com.au> To: Aristedes Maniatis X-Mailer: Apple Mail (2.1993) Cc: freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Jan 2015 08:07:32 -0000 --Apple-Mail=_68BC1EE8-3796-4317-8254-5A246704A3F3 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 27 Jan 2015, at 08:49, Aristedes Maniatis wrote: >=20 > On 27/01/2015 6:46pm, Dimitry Andric wrote: >> On 27 Jan 2015, at 07:25, Aristedes Maniatis wrote: >>>=20 >>> I have been unable to find much documentation about the counter = called "state-mismatch". I notice it going up on my firewall (FreeBSD = 10.1) but only at a slow rate (maybe at around 1 per minute). >>>=20 >>> What is the significance of this value? Is it indicative of dropped = states (and I should be increasing the state timeout)? >>=20 >> It's not really documented in our pfctl(8) manpage, but the OpenBSD = version does >> mention it: >>=20 >> state-mismatch >> packet was associated with a state entry, but sequence = numbers did not >> match >>=20 >> So maybe something is dropping packets, making holes in the sequence = numbers? Or >> maybe somebody is trying something sneaky? :) >>=20 >> -Dimitry >=20 > Ah, thanks for that. Maybe you could add that doc to the FreeBSD man = page. Could it simply be a packet loss issue where a packet is lost and = the next packet arrives out of order? Well, that is just a likely cause. If you let tcpdump run for a while, you might be able to spot it, in e.g. Wireshark? -Dimitry --Apple-Mail=_68BC1EE8-3796-4317-8254-5A246704A3F3 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.26 iEYEARECAAYFAlTHRzoACgkQsF6jCi4glqMxywCguwW1n5GGmyb9DlC7jA5zbzkV HmoAoNfofcPWQByZv9fAU9DPhDdhUo4x =mJ8o -----END PGP SIGNATURE----- --Apple-Mail=_68BC1EE8-3796-4317-8254-5A246704A3F3--