Hello all,
since Dec. 1st I see 60 rejected packets from well known and "good"
SMTP hosts:
Dec 2 12:12:02 binky kernel: [873572.327219] iptables-INVALID IN=eth0
OUT= MAC=00:f1:70:00:58:f0:fc:fb:fb:2d:55:48:08:00 SRC=213.165.67.104
DST=109.75.188.214 LEN=40 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=25 DPT=37022 SEQ=3171195917 ACK=0 WINDOW=0 RES=0x00 RST URGP=0
Why are these logged and rejected?
The rules:
$IPTABLES -A INPUT -m conntrack --ctstate INVALID -m limit \
--limit 3/s -j LOG --log-prefix="iptables-INVALID " \
--log-tcp-sequence --log-tcp-options
$IPTABLES -A INPUT -m conntrack --ctstate INVALID -j DROP
I think this packet was part of the TCP closing handshake, so it should
have been ESTABLISHED and not INVALID. Am I wrong?
Olaf
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
