On Fri, 12 Oct 2007, Jozsef Kadlecsik wrote:
On Fri, 12 Oct 2007, Krzysztof Oledzki wrote:Odd, but I could not reproduce it using my local test webserver.I think you may test it with wp.pl, it is quite a big portal. No harm will be done with little more requests. ;)All of the machines I have got access are behind firewalls.
Oh, I see.
Could you check the patch below?Assuming that I did not mispatched my kernel, this patch does not solve described problem. :(The patch should have been applied on the top of the previous one I sent.
OK. I did it exactly this way.
Do you need more tcpdumps or maybe a "conntrack -o time -E" log?Could you send me a pcap file captured with '-s 0'? Then I could replay it and see what happens.
Attached. Oct 12 19:52:12 wrestler kernel: nf_ct_tcp: invalid packed ignored IN= OUT= SRC=195.177.210.7 DST=212.77.100.101 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=57209 DF PROTO=TCP SPT=50001 DPT=80 SEQ=4171859972 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01C5577D0000000001030306) UID=0 Oct 12 19:52:12 wrestler kernel: nf_ct_tcp: killing out of sync session IN= OUT= SRC=212.77.100.101 DST=195.177.210.7 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=0 DF PROTO=TCP SPT=80 DPT=50001 SEQ=3512463029 ACK=4171859973 WINDOW=5792 RES=0x00 ACK SYN URGP=0 OPT (020405B40402080A2261ACA501C5577D01030302) Please let me know if you need more data. Thank you. Best regards, Krzysztof Olędzki
Attachment:
wplog.gz
Description: Binary data
