Date: Tue, 27 Jan 2015 08:46:24 +0100 From: Dimitry Andric <dim@FreeBSD.org> To: Aristedes Maniatis <ari@ish.com.au> Cc: freebsd-pf@freebsd.org Subject: Re: meaning of State-mismatch Message-ID: <CD5F0D06-3738-4786-97C6-68C27D94A5B0@FreeBSD.org> In-Reply-To: <54C72F63.8040908@ish.com.au> References: <54C72F63.8040908@ish.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
--Apple-Mail=_DC335CBF-B200-4739-BFAC-93546E4EF352
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=us-ascii
On 27 Jan 2015, at 07:25, Aristedes Maniatis <ari@ish.com.au> wrote:
>=20
> I have been unable to find much documentation about the counter called =
"state-mismatch". I notice it going up on my firewall (FreeBSD 10.1) but =
only at a slow rate (maybe at around 1 per minute).
>=20
> What is the significance of this value? Is it indicative of dropped =
states (and I should be increasing the state timeout)?
It's not really documented in our pfctl(8) manpage, but the OpenBSD =
version does
mention it:
state-mismatch
packet was associated with a state entry, but sequence =
numbers did not
match
So maybe something is dropping packets, making holes in the sequence =
numbers? Or
maybe somebody is trying something sneaky? :)
-Dimitry
--Apple-Mail=_DC335CBF-B200-4739-BFAC-93546E4EF352
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename=signature.asc
Content-Type: application/pgp-signature;
name=signature.asc
Content-Description: Message signed with OpenPGP using GPGMail
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.26
iEYEARECAAYFAlTHQlcACgkQsF6jCi4glqOzQgCgqNvy/o3oYNJwI5G8TEJPFUFa
3r0AnjhekhVq1Eoltj4NRewPbPopadPc
=RJek
-----END PGP SIGNATURE-----
--Apple-Mail=_DC335CBF-B200-4739-BFAC-93546E4EF352--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CD5F0D06-3738-4786-97C6-68C27D94A5B0>