[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ipfilter
Subject:    Re: Out of sync packets?
From:       Arjan.deVet () adv ! iae ! nl (Arjan de Vet)
Date:       2000-07-29 22:51:53
[Download RAW message or body]

In article <20000216130250.A9021@pro.icp.ac.ru> you write:

>> from ipmon:
>> 
>> ... @10:1 b <remote_ip>,15243 -> <my_ip>,25 PR tcp len 20 40 -A IN
>> ... @10:1 b <remote_ip>,80 -> <my_ip>,2236 PR tcp len 20 40 -R IN
>> 
>> where the flags can be -A, -R or -AF.
> 
>So do I and there seems to be LOTS of these "wrong" packets. From
>yesterday for about 24 hours I got 1.5 Mb log mostly filled with
>messages about blocked A,R,AF,AP,AR and AFPs. Almost all of them were
>from various Web sites (i.e. source port = 80) to our Web-proxy machine.

[...]

>> Questions:
>> 
>> - Can those packets be safely ignored?
>
>Espesially when you get them hundreds a day? Does anyone observe
>similar behavoiur?

Yes. See if the patch at

	http://www.iae.nl/users/devet/ipfilter/fr_tcp_age/

helps.

Arjan

-- 
Arjan de Vet, Eindhoven, The Netherlands              <Arjan.deVet@adv.iae.nl>
URL: http://www.iae.nl/users/devet/           for PGP key: finger devet@iae.nl

[prev in list] [next in list] [prev in thread] [next in thread]