From nobody Fri Nov 12 15:29:18 2021 X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 67C8D1840861 for ; Fri, 12 Nov 2021 15:29:20 +0000 (UTC) (envelope-from pi@freebsd.org) Received: from fc.opsec.eu (fc.opsec.eu [IPv6:2001:14f8:200:4::4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4HrMvN2Z8Qz4mN1; Fri, 12 Nov 2021 15:29:20 +0000 (UTC) (envelope-from pi@freebsd.org) Received: from pi by fc.opsec.eu with local (Exim 4.95 (FreeBSD)) (envelope-from ) id 1mlYUQ-0004ui-Ux; Fri, 12 Nov 2021 16:29:18 +0100 Date: Fri, 12 Nov 2021 16:29:18 +0100 From: Kurt Jaeger To: tuexen@freebsd.org Cc: freebsd-net@freebsd.org Subject: Re: dtrace to trace incoming connection not suceeding ? Message-ID: References: <866D4765-25EF-4C5F-AA2E-D6BE8D5EBEEB@freebsd.org> <43FC040E-E5DE-4F4E-B91E-AAA807207D05@freebsd.org> List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <43FC040E-E5DE-4F4E-B91E-AAA807207D05@freebsd.org> X-Rspamd-Queue-Id: 4HrMvN2Z8Qz4mN1 X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[] X-Spam: Yes X-ThisMailContainsUnwantedMimeParts: N Hi! > >>> The basic ipfw firewall is active, but > >> Does it work, if you disable ipfw? > > No, unfortunatly not. > OK. Can you provide the output of > netstat -sptcp > after some packets were dropped. https://people.freebsd.org/~pi/logs/netstat-t1.txt https://people.freebsd.org/~pi/logs/netstat-t2.txt 4 connection attempts in that time. On the same 10g ix0 interface we have three VLANs: - one (vlan551) of them uses tcp-md5 for another bgp session - one (vlan500) does not use tcp-md5, and has the problem - one (vlan724) does not use tcp-md5 for bgp, and works fine -- pi@FreeBSD.org +49 171 3101372 Now what ?