Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 1 Aug 2006 19:20:45 +0200
From:      Frank Steinborn <steinex@nognu.de>
To:        Max Laier <max@love2party.net>
Cc:        freebsd-pf@freebsd.org
Subject:   Re: I'm getting sick - Problems filtering IPv6.
Message-ID:  <20060801172045.5ED63B81E@shodan.nognu.de>
In-Reply-To: <200608011905.55505.max@love2party.net>
References:  <20060801142925.54F5CB828@shodan.nognu.de> <200608011905.55505.max@love2party.net>

next in thread | previous in thread | raw e-mail | index | archive | help
Max Laier wrote:
> On Tuesday 01 August 2006 16:29, Frank Steinborn wrote:
> > That's it. It's not possible, and i'm really frustrated for days now.
> > What is actually borked here? Let's have a look on the pflog0, what's
> > dropping:
> >
> > 15:26:35.983709 rule 1/0(match): block in on gif0:
> > 2001:1638:17ad::3.53 > 2001:1638:17ad::3.59761:  tcp 40 [bad hdr
> > length 4 - too short, < 20]
> >
> > Hmm. Bad hdr lenght? What's up here? If i change the rule
> 
> This really just is an artefact from a too short snaplen.  Use -s 1500 and you 
> get rid of it.
> 
> The strange thing, however, is that this is the reply *from* port 53.  So this 
> means the initial SYN got through alright.  Can you check if a state has been 
> created (pfctl -vss) for that connection, please.  I suspect that it has and 
> the problem would be that the reply doesn't match the state - for what ever 
> reason.  Please check if there is a state and let me know - thanks.

Hello Max,

a state is created, yes:

self tcp 2001:1638:17ad::3[53] <- 2001:1638:17ad::3[62810]
SYN_SENT:ESTABLISHED
   [342525613 + 65536](+2469478632) wscale 1  [3355548528 +
65537](+82545723) wscale 1
   [1845438366 + 4880](+1776883750)  [3423429433 + 65535](+3331864375)
   age 00:37:53, expires in 00:00:59, 2204:15980 pkts, 107106:2269450
bytes
   age 01:22:57, expires in 00:01:00, 5472:42944 pkts, 324485:6199453
bytes
   age 02:00:22, expires in 00:00:59, 11249:53620 pkts, 967458:7637333
bytes


Strange thing :-(

Thanks,
Frank



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060801172045.5ED63B81E>