meaning of State-mismatch

Tue Jan 27 08:07:32 UTC 2015

On 27 Jan 2015, at 08:49, Aristedes Maniatis <ari at ish.com.au> wrote:
> 
> On 27/01/2015 6:46pm, Dimitry Andric wrote:
>> On 27 Jan 2015, at 07:25, Aristedes Maniatis <ari at ish.com.au> wrote:
>>> 
>>> I have been unable to find much documentation about the counter called "state-mismatch". I notice it going up on my firewall (FreeBSD 10.1) but only at a slow rate (maybe at around 1 per minute).
>>> 
>>> What is the significance of this value? Is it indicative of dropped states (and I should be increasing the state timeout)?
>> 
>> It's not really documented in our pfctl(8) manpage, but the OpenBSD version does
>> mention it:
>> 
>> state-mismatch
>>           packet was associated with a state entry, but sequence numbers did not
>>           match
>> 
>> So maybe something is dropping packets, making holes in the sequence numbers?  Or
>> maybe somebody is trying something sneaky? :)
>> 
>> -Dimitry
> 
> Ah, thanks for that. Maybe you could add that doc to the FreeBSD man page. Could it simply be a packet loss issue where a packet is lost and the next packet arrives out of order?

Well, that is just a likely cause.  If you let tcpdump run for a while,
you might be able to spot it, in e.g. Wireshark?

-Dimitry

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 194 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20150127/99390b11/attachment.sig>