Re: Solaris OOW issue?
Darren Reed <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.ipfilter |
|---|---|
| Message-ID | <23036_1241814383_4A04956F_23036_5938_1_4A04951C.1020900@reed.wattle.id.au> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vincent Fox wrote: | Further data, I compiled 1.3.42rc5 and replaced the | stock Sun versions with it. The issue persists. So I | do not think this is a simple OOW bug. | | 08/05/2009 10:53:15.141624 bge0 @0:2 b 128.120.32.248,1176 -> 128.120.32.61,389 PR tcp len 20 44 -S IN OOW | 08/05/2009 10:53:23.442391 bge0 @0:2 b 128.120.32.248,1176 -> 128.120.32.61,389 PR tcp len 20 44 -S IN OOW | 08/05/2009 10:53:30.141675 bge0 @0:2 b 128.120.32.248,1176 -> 128.120.32.61,389 PR tcp len 20 40 -R IN OOW | | Any clues anyone? Some simple oversight in my rules | or expectations? The deeper I go into this the less it | seems that I understand. If it reliably happens with a given port number (or pair), can I ask that you use tcpdump to capture all of the packets for this and email me the tcpdump capture file? What I'm suspecting is that a TCP connection is being reused and maybe ipfilter doesn't handle that well. ucdavis...Chico? Also, can you please create a bug on sourceforge? https://sourceforge.net/tracker/?func=add&group_id=169098&atid=849053 Darren -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkoElRwACgkQP7JIXtvLbFXEUgCg2j9uSjWXpmiybCidSO3usl0U TJcAoIZ9lfQS9K6fU0zAhRHUwBnLo0de =S8TU -----END PGP SIGNATURE-----