packets rejected as invalid, why?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello all,

since Dec. 1st I see 60 rejected packets from well known and "good" SMTP hosts:

Dec 2 12:12:02 binky kernel: [873572.327219] iptables-INVALID IN=eth0 OUT= MAC=00:f1:70:00:58:f0:fc:fb:fb:2d:55:48:08:00 SRC=213.165.67.104 DST=109.75.188.214 LEN=40 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP SPT=25 DPT=37022 SEQ=3171195917 ACK=0 WINDOW=0 RES=0x00 RST URGP=0

Why are these logged and rejected?

The rules:

$IPTABLES -A INPUT -m conntrack --ctstate INVALID -m limit \
--limit 3/s -j LOG --log-prefix="iptables-INVALID " \
--log-tcp-sequence --log-tcp-options

$IPTABLES -A INPUT -m conntrack --ctstate INVALID -j DROP

I think this packet was part of the TCP closing handshake, so it should have been ESTABLISHED and not INVALID. Am I wrong?

Olaf
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux