On 14/03/2012 11:28, Yann Hamon wrote:
Hi, I am having an issue related to conntrack and iptables than I am having a hard time fixing. My policy for the OUTPUT chain looks basically like this: Set default policy to DROP DROP all invalid pakets ACCEPT all established an related Then a fairly long list of rules and chains to filter what NEW packets should be allowed out At the end, LOG those that haven't been matched by a previous rule in an unauthorized_outgoing chain. Now I am getting a small number of packets in that chain (about 15-20 per hour, and the server does about 30mbps), like this one: kernel: [12817249.101873] [fw] UNAUTH. OUTGOING CONN.IN= OUT=eth0 SRC=188.xx.xx.xx DST=80.xx.xx.xx LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=59528 DF PROTO=TCP SPT=80 DPT=16258 WINDOW=6432 RES=0x00 ACK URGP=0 I am wondering about a few things in that packet: * Its source port is 80 - the server being a HTTP proxy, this packet is (fairly) likely a reply to another connection * The packet goes into the unauthorized_outgoing logging chain, so the packet doesn't have the state established, related, or invalid : it must be "new". However the packet doesn't have the SYN bit set - it's just an ACK.
It might be a case of Fast Retransmit as per RFC 2001. The duplicate ACK is supposed to be sent by the receiver if segments are received out-of-order. As far as I'm aware, if three such ACKs are received by the sender - all referring to the same segment - then it is assumed by the sender that the segment was never received and that it should be retransmitted as quickly as possible. At that point, the sender would also increase the congestion window and reduce the transmission rate.
My tentative guess would be that, if more than three are seen for the same segment, they are deemed INVALID by the connection tracking system. You could use tcpdump to evaluate this possibility. Alternatively, perhaps someone with a strong knowledge of conntrack internals could confirm one way or the other.
Cheers, --Kerin -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
