Date: Fri, 12 Nov 2021 17:56:08 +0100 From: tuexen@freebsd.org To: Kurt Jaeger <pi@FreeBSD.org> Cc: freebsd-net@freebsd.org Subject: Re: dtrace to trace incoming connection not suceeding ? Message-ID: <36CCF1D0-34EE-4E1C-B593-71CF936F4DE7@freebsd.org> In-Reply-To: <YY6ITiq%2B8x5nw5a/@fc.opsec.eu> References: <YY5nhomjYRnRojwa-v2@fc.opsec.eu> <866D4765-25EF-4C5F-AA2E-D6BE8D5EBEEB@freebsd.org> <YY6C2/OyG3KTvV%2BM@fc.opsec.eu> <43FC040E-E5DE-4F4E-B91E-AAA807207D05@freebsd.org> <YY6ITiq%2B8x5nw5a/@fc.opsec.eu>
next in thread | previous in thread | raw e-mail | index | archive | help
> On 12. Nov 2021, at 16:29, Kurt Jaeger <pi@FreeBSD.org> wrote: > > Hi! > >>>>> The basic ipfw firewall is active, but >>>> Does it work, if you disable ipfw? > >>> No, unfortunatly not. > >> OK. Can you provide the output of >> netstat -sptcp >> after some packets were dropped. > > https://people.freebsd.org/~pi/logs/netstat-t1.txt > https://people.freebsd.org/~pi/logs/netstat-t2.txt Not sure why you provide two outputs. Does 'the discarded for bad checksums' counter increase incoming SYN segments are not responded to. If you capture the incoming traffic with Wireshark, does it report that the checksum is wrong? > > 4 connection attempts in that time. > > On the same 10g ix0 interface we have three VLANs: > - one (vlan551) of them uses tcp-md5 for another bgp session > - one (vlan500) does not use tcp-md5, and has the problem > - one (vlan724) does not use tcp-md5 for bgp, and works fine Possibly the usage of vlans is relevant for this issue. Not sure. Best regards Michael > > -- > pi@FreeBSD.org +49 171 3101372 Now what ? >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?36CCF1D0-34EE-4E1C-B593-71CF936F4DE7>