From owner-freebsd-questions@FreeBSD.ORG Tue Nov 13 16:45:22 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 22F1416A419 for ; Tue, 13 Nov 2007 16:45:22 +0000 (UTC) (envelope-from erik@cepheid.org) Received: from mail.cepheid.org (aleph.cepheid.org [72.232.60.94]) by mx1.freebsd.org (Postfix) with ESMTP id F0AFE13C4AC for ; Tue, 13 Nov 2007 16:45:21 +0000 (UTC) (envelope-from erik@cepheid.org) Received: by mail.cepheid.org (Postfix, from userid 1006) id E9EC49B4057; Tue, 13 Nov 2007 10:45:14 -0600 (CST) Date: Tue, 13 Nov 2007 10:45:14 -0600 From: Erik Osterholm To: freebsd-questions@freebsd.org Message-ID: <20071113164514.GA86464@aleph.cepheid.org> Mail-Followup-To: Erik Osterholm , freebsd-questions@freebsd.org, girishvenkatachalam@gmail.com References: <669132de0711121208n32bfb827p4984c6d3383da713@mail.gmail.com> <20071113022053.GA17768@saraswathy.susmita.org> <20071113054220.GA74564@aleph.cepheid.org> <20071113132734.GA16728@saraswathy.susmita.org> <20071113135523.GA13178@saraswathy.susmita.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20071113135523.GA13178@saraswathy.susmita.org> User-Agent: Mutt/1.4.2.3i Cc: girishvenkatachalam@gmail.com Subject: Re: PF, bridge, states and window scaling problem X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Nov 2007 16:45:22 -0000 On Tue, Nov 13, 2007 at 07:25:23PM +0530, Girish Venkatachalam wrote: > On 18:57:34 Nov 13, Girish Venkatachalam wrote: > > I just read the post you linked. Thanks. :) > > I read the post once again and it looks as though I understood what is > mentioned there. > > The 'no-df' in scrub rule clears the Don't fragment bit in the IP > header. When a host wrongly sends fragmented packets with the DF bit > set, this scrub rule "correctly" resets the DF bit. > > Now since the host made the mistake of sending a fragmented packet with > DF bit set ( this is like saying " Please don't fragment my packet, but > I myself have fragmented". Odd...) no-df scrub rule causes trouble. > > Scrub never causes trouble with properly formed packets. > > regards, > Girish Ah, that makes sense! In fact, if I'd done a little more reading, I'd see that OpenBSD suggests the same: http://www.openbsd.org/faq/pf/scrub.html They mention that there are some problems (NFS specifically, and "some online games"). I believe that we've also seen some weird behavior with Active Directory, but I'd have to check to make sure. Thanks for the information! Erik