Weird problems with 'pf' (on both 5.x and 6.x)
stb at lassitu.de
Fri Jul 28 19:30:56 UTC 2006
Am 28.07.2006 um 03:57 schrieb Garance A Drosihn:
> It occurred to me that it might be more informative to
> see the transaction from the *freebsd* side of things,
> since that's the machine running pf! So, here is a
> similar set of two lpq's, as seen from the print-server
> side of the connection. It seems to be telling the
> same basic story, as far as I can tell.
It's just showing that no ACKs come back. Can you see if anything
showing pflog0 with tcpdump? That output should also tell you which
rule forced the rejection.
What I do find curious is that the client keeps using port 1023
consistently. I was under the impression that reusing the same port
number (thus having the same src-ip/port+dst-ip/port tuple) shouldn't
work, because "old" packets could arrive after the original
connection was closed; that's what the CLOSE_WAIT state in netstat is.
Stefan Bethke <stb at lassitu.de> Fon +49 170 346 0140
More information about the freebsd-stable