This is on a machine sitting behind another firewall. It runs debian,
with debian linux-image-2.6.18-5-686 2.6.18.dfsg.1-13etch2.
Once in a while, we see some unexpected ACK+RST going out of the server
(the incoming SYN should have been dropped since the source port is not
explicitely allowed in INPUT):
On Thu, Sep 13, 2007 at 09:02:12 +0200, logcheck system account wrote:
> Sep 13 08:35:09 kernel: IN= OUT=eth0 SRC=140.77.x.y DST=152.77.24.38 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=17699 DF PROTO=TCP SPT=54597 DPT=62603 WINDOW=952 RES=0x00 ACK RST URGP=0
On Sat, Sep 15, 2007 at 20:02:12 +0200, logcheck system account wrote:
> Sep 15 19:53:28 kernel: IN= OUT=eth0 SRC=140.77.x.y DST=61.29.145.234 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=28476 DF PROTO=TCP SPT=41636 DPT=2948 WINDOW=5840 RES=0x00 ACK RST URGP=0
> Sep 15 19:53:31 kernel: IN= OUT=eth0 SRC=140.77.x.y DST=61.29.145.234 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=43810 DF PROTO=TCP SPT=36437 DPT=2868 WINDOW=5840 RES=0x00 ACK RST URGP=0
On Sun, Sep 16, 2007 at 05:02:12 +0200, logcheck system account wrote:
> Sep 16 04:52:53 kernel: IN= OUT=eth0 SRC=140.77.x.y DST=221.206.165.157 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=41883 DF PROTO=TCP SPT=54608 DPT=1786 WINDOW=5840 RES=0x00 ACK RST URGP=0
iptables -v -L looks like this (mangle and nat are empty):
Chain INPUT (policy DROP 19 packets, 988 bytes)
pkts bytes target prot opt in out source destination
7060K 2416M ACCEPT 0 -- lo * 0.0.0.0/0 0.0.0.0/0
200 17395 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
264K 28M ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
1364K 917M ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
1 40 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
282K 16M ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
177K 44M ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
10377 917K ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp spt:22
766K 56M ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp spt:25
3532 644K ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp spt:53
812K 154M ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp spt:53
0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
6686 508K ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp spt:123
0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:123
41603 2569K ACCEPT tcp -- eth0 * 140.77.0.0/16 0.0.0.0/0 tcp dpt:1119
132K 9442K ACCEPT tcp -- eth0 * 140.77.0.0/16 0.0.0.0/0 tcp dpt:4030
35174 4593K DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type BROADCAST
9876 316K DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type MULTICAST
530 26036 REJECT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 reject-with icmp-port-unreachable
132 6336 DROP tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 multiport dports 135:139,445
0 0 DROP udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 multiport dports 135:139,445
18 936 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy DROP 12 packets, 624 bytes)
pkts bytes target prot opt in out source destination
7060K 2416M ACCEPT 0 -- * lo 0.0.0.0/0 0.0.0.0/0
2865 360K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
264K 172M ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp spt:22
1210K 90M ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp spt:25
1 40 ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp spt:53
535K 775M ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp spt:80
232K 264M ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp spt:443
28184 2609K ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
1030K 989M ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
4235 251K ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
0 0 ACCEPT udp -- * eth0 0.0.0.0/0 0.0.0.0/0 udp spt:53
822K 62M ACCEPT udp -- * eth0 0.0.0.0/0 0.0.0.0/0 udp dpt:53
7017 533K ACCEPT udp -- * eth0 0.0.0.0/0 0.0.0.0/0 udp spt:123
0 0 ACCEPT udp -- * eth0 0.0.0.0/0 0.0.0.0/0 udp dpt:123
33220 4951K ACCEPT tcp -- * eth0 0.0.0.0/0 140.77.0.0/16 tcp spt:1119
103K 34M ACCEPT tcp -- * eth0 0.0.0.0/0 140.77.0.0/16 tcp spt:4030
12 624 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4
related modules loaded:
iptable_mangle 2880 0
iptable_nat 7044 0
ip_nat 16876 1 iptable_nat
ip_conntrack 49088 2 iptable_nat,ip_nat
nfnetlink 6680 2 ip_nat,ip_conntrack
ipt_LOG 6112 2
xt_multiport 3264 2
ipt_REJECT 5248 1
ipt_addrtype 1952 2
xt_tcpudp 3136 61
iptable_filter 3104 1
ip_tables 13028 3
iptable_mangle,iptable_nat,iptable_filter
x_tables 13316 7
iptable_nat,ipt_LOG,xt_multiport,ipt_REJECT,ipt_addrtype,xt_tcpudp,ip_tables
anything obvious we missed, or is this a bug somewhere ?
regards,
Benoit
--
:wq
