I'm getting sick - Problems filtering IPv6.

[Max Laier]

On Tuesday 01 August 2006 19:20, Frank Steinborn wrote:
> Max Laier wrote:
> > On Tuesday 01 August 2006 16:29, Frank Steinborn wrote:
> > > That's it. It's not possible, and i'm really frustrated for days now.
> > > What is actually borked here? Let's have a look on the pflog0, what's
> > > dropping:
> > >
> > > 15:26:35.983709 rule 1/0(match): block in on gif0:
> > > 2001:1638:17ad::3.53 > 2001:1638:17ad::3.59761:  tcp 40 [bad hdr
> > > length 4 - too short, < 20]
> > >
> > > Hmm. Bad hdr lenght? What's up here? If i change the rule
> >
> > This really just is an artefact from a too short snaplen.  Use -s 1500
> > and you get rid of it.
> >
> > The strange thing, however, is that this is the reply *from* port 53.  So
> > this means the initial SYN got through alright.  Can you check if a state
> > has been created (pfctl -vss) for that connection, please.  I suspect
> > that it has and the problem would be that the reply doesn't match the
> > state - for what ever reason.  Please check if there is a state and let
> > me know - thanks.
>
> Hello Max,
>
> a state is created, yes:
>
> self tcp 2001:1638:17ad::3[53] <- 2001:1638:17ad::3[62810]
> SYN_SENT:ESTABLISHED
>    [342525613 + 65536](+2469478632) wscale 1  [3355548528 +
> 65537](+82545723) wscale 1
>    [1845438366 + 4880](+1776883750)  [3423429433 + 65535](+3331864375)
>    age 00:37:53, expires in 00:00:59, 2204:15980 pkts, 107106:2269450
> bytes
>    age 01:22:57, expires in 00:01:00, 5472:42944 pkts, 324485:6199453
> bytes
>    age 02:00:22, expires in 00:00:59, 11249:53620 pkts, 967458:7637333
> bytes
>
>
> Strange thing :-(

Indeed, and far from what I expected to see.  These states exist for a long 
time and have seen lots of packets in both directions.  Are you sure you 
copied the right counters for that state?  Can you please enable extended 
logging with "pfctl -x misc" and report any related messages from console.  
Also, please recheck pfctl -vss for the right state counters.  I do get this 
right, the "telnet 2001:1638:17ad::3 53" stalled right away?

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20060802/6dd68f35/attachment.pgp