From owner-freebsd-pf@FreeBSD.ORG  Tue Jan 27 07:46:35 2015
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 7CFE4AF1
 for <freebsd-pf@freebsd.org>; Tue, 27 Jan 2015 07:46:35 +0000 (UTC)
Received: from tensor.andric.com (unknown
 [IPv6:2001:7b8:3a7:1:2d0:b7ff:fea0:8c26])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "tensor.andric.com",
 Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 3B49DDC2
 for <freebsd-pf@freebsd.org>; Tue, 27 Jan 2015 07:46:35 +0000 (UTC)
Received: from [IPv6:2001:7b8:3a7::c917:66ee:a8b8:73e5] (unknown
 [IPv6:2001:7b8:3a7:0:c917:66ee:a8b8:73e5])
 (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by tensor.andric.com (Postfix) with ESMTPSA id 146A55C2E;
 Tue, 27 Jan 2015 08:46:32 +0100 (CET)
Subject: Re: meaning of State-mismatch
Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\))
Content-Type: multipart/signed;
 boundary="Apple-Mail=_DC335CBF-B200-4739-BFAC-93546E4EF352";
 protocol="application/pgp-signature"; micalg=pgp-sha1
X-Pgp-Agent: GPGMail 2.5b4
From: Dimitry Andric <dim@FreeBSD.org>
In-Reply-To: <54C72F63.8040908@ish.com.au>
Date: Tue, 27 Jan 2015 08:46:24 +0100
Message-Id: <CD5F0D06-3738-4786-97C6-68C27D94A5B0@FreeBSD.org>
References: <54C72F63.8040908@ish.com.au>
To: Aristedes Maniatis <ari@ish.com.au>
X-Mailer: Apple Mail (2.1993)
Cc: freebsd-pf@freebsd.org
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Jan 2015 07:46:35 -0000


--Apple-Mail=_DC335CBF-B200-4739-BFAC-93546E4EF352
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

On 27 Jan 2015, at 07:25, Aristedes Maniatis <ari@ish.com.au> wrote:
>=20
> I have been unable to find much documentation about the counter called =
"state-mismatch". I notice it going up on my firewall (FreeBSD 10.1) but =
only at a slow rate (maybe at around 1 per minute).
>=20
> What is the significance of this value? Is it indicative of dropped =
states (and I should be increasing the state timeout)?

It's not really documented in our pfctl(8) manpage, but the OpenBSD =
version does
mention it:

state-mismatch
           packet was associated with a state entry, but sequence =
numbers did not
           match

So maybe something is dropping packets, making holes in the sequence =
numbers?  Or
maybe somebody is trying something sneaky? :)

-Dimitry


--Apple-Mail=_DC335CBF-B200-4739-BFAC-93546E4EF352
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP using GPGMail

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.26

iEYEARECAAYFAlTHQlcACgkQsF6jCi4glqOzQgCgqNvy/o3oYNJwI5G8TEJPFUFa
3r0AnjhekhVq1Eoltj4NRewPbPopadPc
=RJek
-----END PGP SIGNATURE-----

--Apple-Mail=_DC335CBF-B200-4739-BFAC-93546E4EF352--