Date: Tue, 27 Jan 2015 08:46:24 +0100 From: Dimitry Andric <dim@FreeBSD.org> To: Aristedes Maniatis <ari@ish.com.au> Cc: freebsd-pf@freebsd.org Subject: Re: meaning of State-mismatch Message-ID: <CD5F0D06-3738-4786-97C6-68C27D94A5B0@FreeBSD.org> In-Reply-To: <54C72F63.8040908@ish.com.au> References: <54C72F63.8040908@ish.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On 27 Jan 2015, at 07:25, Aristedes Maniatis <ari@ish.com.au> wrote:
>
> I have been unable to find much documentation about the counter called "state-mismatch". I notice it going up on my firewall (FreeBSD 10.1) but only at a slow rate (maybe at around 1 per minute).
>
> What is the significance of this value? Is it indicative of dropped states (and I should be increasing the state timeout)?
It's not really documented in our pfctl(8) manpage, but the OpenBSD version does
mention it:
state-mismatch
packet was associated with a state entry, but sequence numbers did not
match
So maybe something is dropping packets, making holes in the sequence numbers? Or
maybe somebody is trying something sneaky? :)
-Dimitry
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.26
iEYEARECAAYFAlTHQlcACgkQsF6jCi4glqOzQgCgqNvy/o3oYNJwI5G8TEJPFUFa
3r0AnjhekhVq1Eoltj4NRewPbPopadPc
=RJek
-----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CD5F0D06-3738-4786-97C6-68C27D94A5B0>