Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 2 Aug 2006 16:01:42 +0200
From:      Max Laier <max@love2party.net>
To:        Frank Steinborn <steinex@nognu.de>
Cc:        freebsd-pf@freebsd.org
Subject:   Re: I'm getting sick - Problems filtering IPv6.
Message-ID:  <200608021601.49038.max@love2party.net>
In-Reply-To: <20060801172045.5ED63B81E@shodan.nognu.de>
References:  <20060801142925.54F5CB828@shodan.nognu.de> <200608011905.55505.max@love2party.net> <20060801172045.5ED63B81E@shodan.nognu.de>

next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1608172.dqaTIbRbDV
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Tuesday 01 August 2006 19:20, Frank Steinborn wrote:
> Max Laier wrote:
> > On Tuesday 01 August 2006 16:29, Frank Steinborn wrote:
> > > That's it. It's not possible, and i'm really frustrated for days now.
> > > What is actually borked here? Let's have a look on the pflog0, what's
> > > dropping:
> > >
> > > 15:26:35.983709 rule 1/0(match): block in on gif0:
> > > 2001:1638:17ad::3.53 > 2001:1638:17ad::3.59761:  tcp 40 [bad hdr
> > > length 4 - too short, < 20]
> > >
> > > Hmm. Bad hdr lenght? What's up here? If i change the rule
> >
> > This really just is an artefact from a too short snaplen.  Use -s 1500
> > and you get rid of it.
> >
> > The strange thing, however, is that this is the reply *from* port 53.  =
So
> > this means the initial SYN got through alright.  Can you check if a sta=
te
> > has been created (pfctl -vss) for that connection, please.  I suspect
> > that it has and the problem would be that the reply doesn't match the
> > state - for what ever reason.  Please check if there is a state and let
> > me know - thanks.
>
> Hello Max,
>
> a state is created, yes:
>
> self tcp 2001:1638:17ad::3[53] <- 2001:1638:17ad::3[62810]
> SYN_SENT:ESTABLISHED
>    [342525613 + 65536](+2469478632) wscale 1  [3355548528 +
> 65537](+82545723) wscale 1
>    [1845438366 + 4880](+1776883750)  [3423429433 + 65535](+3331864375)
>    age 00:37:53, expires in 00:00:59, 2204:15980 pkts, 107106:2269450
> bytes
>    age 01:22:57, expires in 00:01:00, 5472:42944 pkts, 324485:6199453
> bytes
>    age 02:00:22, expires in 00:00:59, 11249:53620 pkts, 967458:7637333
> bytes
>
>
> Strange thing :-(

Indeed, and far from what I expected to see.  These states exist for a long=
=20
time and have seen lots of packets in both directions.  Are you sure you=20
copied the right counters for that state?  Can you please enable extended=20
logging with "pfctl -x misc" and report any related messages from console. =
=20
Also, please recheck pfctl -vss for the right state counters.  I do get thi=
s=20
right, the "telnet 2001:1638:17ad::3 53" stalled right away?

=2D-=20
/"\  Best regards,                      | mlaier@freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier@EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News

--nextPart1608172.dqaTIbRbDV
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (FreeBSD)

iD8DBQBE0LBNXyyEoT62BG0RAnXOAJ91YKj5tdX9sjThiF2zfLqq57/7SgCeJQ6l
eENGizH8hmPcek+JxvULnN8=
=34Bi
-----END PGP SIGNATURE-----

--nextPart1608172.dqaTIbRbDV--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200608021601.49038.max>