Hi!
I'm fighting with some strange log entries in my firewall.
The machine is a proxy server and these entries appear only while the
proxy (squid) is heavily used. (about 200 hits/minute, so I don't think
it's caused by ip_conntrack_max=16376)
I allow all ESTABLISHED,RELATED connections and of course some ports
(8080) in the INPUT chain and all connections in the OUTPUT chain.
The rest of the INPUT chain is logged with stateNEW or stateINVALID prefix.
e.g.:
stateNEW: IN=eth1 OUT= MAC=xxx SRC=131.131.131.131 DST=193.193.193.193
LEN=1500 TOS=0x00 PREC=0x00 TTL=47 ID=10226 DF PROTO=TCP SPT=80
DPT=37678 WINDOW=33304 RES=0x00 ACK URGP=0
The flags vary. ACK - ACK,FIN.- ACK,PSH,FIN
Does anybody know the reason for this? Bug in netfilter, bug in remote
system?
Willi Mann
