> On 19 Sep 2014, at 21:41, Nikos Mavrogiannopoulos <nmav at gnutls.org> wrote: > Is anything related in the ocserv logs about this client? Does his > device exist? Any other kernel related messages that could help? Sep 18 22:13:47 fanupiri ocserv[4444]: sec-mod: auth init for user ?XXX' (group: '') from ?1.1.1.1' Sep 18 22:13:54 fanupiri ocserv[4442]: main: 1.1.1.1:51466 main-misc.c:414: command socket closed Sep 18 22:13:55 fanupiri ocserv[4442]: main: 1.1.1.1:51467 main-misc.c:414: command socket closed Sep 18 22:13:56 fanupiri ocserv[4442]: main: 1.1.1.1:51468 assigned IPv4 to ?XXX': 10.255.232.69 Sep 18 22:13:56 fanupiri ocserv[4442]: main: 1.1.1.1:51468 assigning tun device tun_oc9 Sep 18 22:13:56 fanupiri ocserv[4442]: main: 1.1.1.1:51468 user ?XXX' of group '[unknown]' authenticated (using cookie) Sep 18 22:13:57 fanupiri ocserv[4442]: main: 1.1.1.1:51465 main-misc.c:414: command socket closed Sep 18 22:13:57 fanupiri ocserv[4442]: main: 1.1.1.1:51465 main-misc.c:414: command socket closed Sep 18 22:26:12 fanupiri ocserv[4442]: main: 1.1.1.1:51468 main-misc.c:414: command socket closed Output from strongswan and ntpd suggests that the tun_oc9 device is taken down: Sep 18 22:26:12 fanupiri charon: 12[KNL] interface tun_oc9 deactivated Sep 18 22:26:12 fanupiri charon: 07[KNL] interface tun_oc9 deleted Sep 18 22:26:14 fanupiri ntpd[13026]: Deleting interface #130 tun_oc9, 10.255.232.68#123, interface stats: received=0, sent=0, dropped=0, active_time=737 secs And ocserv re-uses it for a different user later: Sep 18 23:58:56 fanupiri ocserv[4442]: main: 2.2.2.2:47417 assigning tun device tun_oc9 Occasionally I see this, but with multiple users online at any time I can?t identify who causes it. I also see it when the problem does not occur. (Off-topic: perhaps ocserv could log the originating IP.) Sep 18 22:14:13 fanupiri ocserv[4442]: main: could not determine the owner of received UDP packet Regards, Niels
