meaning of State-mismatch

[Dimitry Andric]

On 27 Jan 2015, at 07:25, Aristedes Maniatis <ari at ish.com.au> wrote:
> 
> I have been unable to find much documentation about the counter called "state-mismatch". I notice it going up on my firewall (FreeBSD 10.1) but only at a slow rate (maybe at around 1 per minute).
> 
> What is the significance of this value? Is it indicative of dropped states (and I should be increasing the state timeout)?

It's not really documented in our pfctl(8) manpage, but the OpenBSD version does
mention it:

state-mismatch
           packet was associated with a state entry, but sequence numbers did not
           match

So maybe something is dropping packets, making holes in the sequence numbers?  Or
maybe somebody is trying something sneaky? :)

-Dimitry

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 194 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20150127/74570d35/attachment.sig>