From owner-freebsd-stable@freebsd.org Wed Feb 15 14:57:02 2017 Return-Path: Delivered-To: freebsd-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D1EB0CDFB5F for ; Wed, 15 Feb 2017 14:57:02 +0000 (UTC) (envelope-from Mark.Martinec+freebsd@ijs.si) Received: from mail.ijs.si (mail.ijs.si [IPv6:2001:1470:ff80::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 7A5AB83C; Wed, 15 Feb 2017 14:57:02 +0000 (UTC) (envelope-from Mark.Martinec+freebsd@ijs.si) Received: from amavis-ori.ijs.si (localhost [IPv6:::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.ijs.si (Postfix) with ESMTPS id 3vNj6s45Gxz1Jd; Wed, 15 Feb 2017 15:56:53 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ijs.si; h= user-agent:message-id:references:in-reply-to:organization :subject:subject:from:from:date:date:content-transfer-encoding :content-type:content-type:mime-version:received:received :received:received; s=jakla4; t=1487170609; x=1489762610; bh=4vi NOMYxBoQaC5Bxn027ZAwkV23mAZz001REfzBydQk=; b=BaDZE04mHeFalTFSQdE DGnlTUvS8qO2N6sdyjDcshcBCHmoAvx29HweQcdYGLTAjJ/1EUt7h216UUE8IJok tlgDZL92kY2JQwPV0g1BGU/bfcTKGmuFErDFuMW6pEKrTjzXa1wddMQKNYsxmXjs 4jRcaOHcttGwWkhhG71CHM28= X-Virus-Scanned: amavisd-new at ijs.si Received: from mail.ijs.si ([IPv6:::1]) by amavis-ori.ijs.si (mail.ijs.si [IPv6:::1]) (amavisd-new, port 10026) with LMTP id uctXztIR73S6; Wed, 15 Feb 2017 15:56:49 +0100 (CET) Received: from mildred.ijs.si (mailbox.ijs.si [IPv6:2001:1470:ff80::143:1]) by mail.ijs.si (Postfix) with ESMTP id 3vNj6d0k84z1JY; Wed, 15 Feb 2017 15:56:41 +0100 (CET) Received: from nabiralnik.ijs.si (nabiralnik.ijs.si [IPv6:2001:1470:ff80::80:16]) by mildred.ijs.si (Postfix) with ESMTP id 3vNj6c6zLHzvw; Wed, 15 Feb 2017 15:56:40 +0100 (CET) Received: from neli.ijs.si (2001:1470:ff80:88:21c:c0ff:feb1:8c91) by nabiralnik.ijs.si with HTTP (HTTP/1.1 POST); Wed, 15 Feb 2017 15:56:40 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Wed, 15 Feb 2017 15:56:40 +0100 From: Mark Martinec To: freebsd-stable@freebsd.org Cc: Eric van Gyzen Subject: Re: net.inet.udp.log_in_vain strange syslog reports Organization: Jozef Stefan Institute In-Reply-To: <7dca33f9-e817-7d79-bddd-332e745a1c05@FreeBSD.org> References: <76681a24b7935674585b5ac585f4575c@ijs.si> <667fa3e1dd8e7cebbf4566467a7987bf@ijs.si> <7dca33f9-e817-7d79-bddd-332e745a1c05@FreeBSD.org> Message-ID: <318110819f687c06e6d412955bbac6b1@ijs.si> X-Sender: Mark.Martinec+freebsd@ijs.si User-Agent: Roundcube Webmail/1.2.3 X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Feb 2017 14:57:02 -0000 2017-02-06 18:04, Eric van Gyzen wrote: > On 02/06/2017 10:19, Mark Martinec wrote: >> Hope the fix finds its way into 11.1 (or better yet, as a patch level >> in 10.0). Should I open a bug report? > > It will quite likely get into 11.1. As for a 10.x patch, you would > have > to ask re@ (I think), but I doubt it. These messages are really just > informative and can't be used for any filtering, since the source > address could be spoofed. I meant to say 11.0-p*, but nevermind. In a similar vein, I noticed also the following in our logs, with net.inet.tcp.log_in_vain=1. Looks like messages got concatenated somehow: Jan 25 01:37:53 mildred kernel: TCP: [2607:ff10:c5:509a::10]:26459 to [2001:1470:ff80::80:16]:4911 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:14898 to [2001:1470:ff80::80:16]:5222 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 25 23:55:09 mildred kernel: TCP: [2607:ff10:c5:509a::10]:58022 to [2001:1470:ff80::80:16]:9981 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:34680 to [2001:1470:ff80::80:16]:10243 tcpflags 0x2; tcp_input: Connection attempt to closedport Jan 25 23:55:09 mildred kernel: TCP: [2607:ff10:c5:509a::10]:30991 to [2001:1470:ff80::80:16]:8554 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:20012 to [2001:1470:ff80::80:16]:8443 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 25 23:55:09 mildred kernel: TCP: [2607:ff10:c5:509a::10]:14166 to [2001:1470:ff80::80:16]:6666 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:34680 to [2001:1470:ff80::80:16]:8010 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 25 23:55:09 mildred kernel: TCP: [2607:ff10:c5:509a::10]:47957 to [2001:1470:ff80::80:16]:3460 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:34680 to [2001:1470:ff80::80:16]:13579 tcpflags 0x2; tcp_input: Connection attempt to closedport Jan 25 23:55:09 mildred kernel: TCP: [2607:ff10:c5:509a::10]:20012 to [2001:1470:ff80::80:16]:9001 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:30651 to [2001:1470:ff80::80:16]:9000 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 12 04:50:58 mildred kernel: TCP: [2607:ff10:c5:509a::1]:42266 to [2001:1470:ff80::80:16]:49153 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::1]:35372 to [2001:1470:ff80::80:16]:62078 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 18 03:01:59 mildred kernel: TCP: [2607:ff10:c5:509a::10]:58022 to [2001:1470:ff80::80:16]:9200 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:46640 to [2001:1470:ff80::80:16]:8181 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 18 03:01:59 mildred kernel: TCP: [2607:ff10:c5:509a::10]:36877 to [2001:1470:ff80::80:16]:7218 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:46640 to [2001:1470:ff80::80:16]:7071 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 18 03:01:59 mildred kernel: TCP: [2607:ff10:c5:509a::10]:30651 to [2001:1470:ff80::80:16]:9000 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:36877 to [2001:1470:ff80::80:16]:2332 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 18 03:01:59 mildred kernel: TCP: [2607:ff10:c5:509a::10]:46640 to [2001:1470:ff80::80:16]:7548 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:46640 to [2001:1470:ff80::80:16]:5986 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 19 02:52:34 mildred kernel: TCP: [2607:ff10:c5:509a::1]:42266 to [2001:1470:ff80::80:16]:49153 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::1]:35372 to [2001:1470:ff80::80:16]:62078 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 19 02:52:34 mildred kernel: TCP: [2607:ff10:c5:509a::1]:61788 to [2001:1470:ff80::80:16]:20000 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::1]:34680 to [2001:1470:ff80::80:16]:10243 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 19 02:52:34 mildred kernel: TCP: [2607:ff10:c5:509a::1]:41249 to [2001:1470:ff80::80:16]:44818 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::1]:49717 to [2001:1470:ff80::80:16]:8649 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 20 04:49:15 mildred kernel: TCP: [2607:ff10:c5:509a::1]:36877 to [2001:1470:ff80::143:1]:50100 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::1]:42266 to [2001:1470:ff80::143:1]:49153 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 20 10:03:52 mildred kernel: TCP: [2607:ff10:c5:509a::10]:31430 to [2001:1470:ff80::143:1]:8099 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:46640 to [2001:1470:ff80::143:1]:9943 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 20 10:03:52 mildred kernel: TCP: [2607:ff10:c5:509a::10]:9696 to [2001:1470:ff80::143:1]:16010 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:34680 to [2001:1470:ff80::143:1]:25105 tcpflags 0x2; tcp_input: Connection attempt to closedport Jan 20 10:03:52 mildred kernel: TCP: [2607:ff10:c5:509a::10]:34680 to [2001:1470:ff80::143:1]:4040 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:23668 to [2001:1470:ff80::143:1]:5577 tcpflags 0x2; tcp_input: Connection attempt to closed port Jan 20 10:03:52 mildred kernel: TCP: [2607:ff10:c5:509a::10]:1940 to [2001:1470:ff80::143:1]:49152 tcpflags 0x2; tcp_input: Connection attempt to closed TCP: [2607:ff10:c5:509a::10]:6440 to [2001:1470:ff80::143:1]:5672 tcpflags 0x2; tcp_input: Connection attempt to closed pport Mark