meaning of State-mismatch

[Aristedes Maniatis]

On 27/01/2015 7:07pm, Dimitry Andric wrote:
> On 27 Jan 2015, at 08:49, Aristedes Maniatis <ari at ish.com.au> wrote:
>>
>> On 27/01/2015 6:46pm, Dimitry Andric wrote:
>>> On 27 Jan 2015, at 07:25, Aristedes Maniatis <ari at ish.com.au> wrote:
>>>>
>>>> I have been unable to find much documentation about the counter called "state-mismatch". I notice it going up on my firewall (FreeBSD 10.1) but only at a slow rate (maybe at around 1 per minute).
>>>>
>>>> What is the significance of this value? Is it indicative of dropped states (and I should be increasing the state timeout)?
>>>
>>> It's not really documented in our pfctl(8) manpage, but the OpenBSD version does
>>> mention it:
>>>
>>> state-mismatch
>>>           packet was associated with a state entry, but sequence numbers did not
>>>           match
>>>
>>> So maybe something is dropping packets, making holes in the sequence numbers?  Or
>>> maybe somebody is trying something sneaky? :)
>>>
>>> -Dimitry
>>
>> Ah, thanks for that. Maybe you could add that doc to the FreeBSD man page. Could it simply be a packet loss issue where a packet is lost and the next packet arrives out of order?
> 
> Well, that is just a likely cause.  If you let tcpdump run for a while,
> you might be able to spot it, in e.g. Wireshark?
> 
> -Dimitry
> 

If I attach tcpdump to pflog0 is there an easy way to filter for just these events? I assume there is nothing like "block in log flags state-mismatch" to trap these packets? If I knew which IP and port they were going to, I'd have a better idea of where to look.

Ari


-- 
-------------------------->
Aristedes Maniatis
ish
http://www.ish.com.au
Level 1, 30 Wilson Street Newtown 2042 Australia
phone +61 2 9550 5001   fax +61 2 9550 4001
GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A