> That's strange then: the traffic dump you posted contained the client > SYN request but did not show the SYN/ACK reply from the server at all. > > What does it mean 'drop iptables/restart firewall'? Delete all rules, > remove all modules including ip_conntrack and restart? > > Best regards, > Jozsef > - > E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxxxxx > PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt > Address : KFKI Research Institute for Particle and Nuclear Physics > H-1525 Budapest 114, POB. 49, Hungary Exactly. I tried removing every ipt and iptables-related modules, and then re-running the iptables script and then everything is good again - very odd. I normally use netstat-nat to give a quick human-readable view of what's in the conntrack table, is there any other tools that are better/easier? Is there any debug/tracing that I can do at the netfilter level to see how these packets are being processed? I know I can use iptables and log it that way, but that doesn't seem to be catching what's really going on. The unfortunately part is this usually takes days for this to start manifesting itself again, so hopefully sometime this week I can get for trace data. Thanks again, Dan
