Re: [long] NPF and open ports

Greg Troxel a écrit :
> I would run tcpdump on the interface you think it answering and look at
> the packets, and then probe with telnet to the port (vs nmap) and then
> use the ftp command.
> 
> I would also use npfctl to examine the rules to make sure the source
> rules correspond to the parsed rules, the rules you think are loaded are
> loaded etc.
> 

	"npfctl show" exactly returns my /etc/npf.conf file.

	Now, if I try to access to my server from WAN (for example with mpv
rtsp://legendre.systella.fr ou regular telnet legendre.systella.fr 554),
tcpdump shows :

legendre# tcpdump -p -i wm2 port 554
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wm2, link-type EN10MB (Ethernet), snapshot length 262144 bytes
18:38:53.652322 IP 92-184-144-1.mobile.fr.orangecustomers.net.60592 >
legendre.systella.fr.rtsp: Flags [S], seq 2252270373, win 63664, options
[mss 1384,nop,wscale 8,sackOK,TS val 1142338508 ecr 0], length 0
18:38:54.051511 IP 92-184-144-1.mobile.fr.orangecustomers.net.60592 >
legendre.systella.fr.rtsp: Flags [S], seq 2252270373, win 63664, options
[mss 1384,nop,wscale 8,sackOK,TS val 1142338908 ecr 0], length 0
18:38:54.451667 IP 92-184-144-1.mobile.fr.orangecustomers.net.60592 >
legendre.systella.fr.rtsp: Flags [S], seq 2252270373, win 63664, options
[mss 1384,nop,wscale 8,sackOK,TS val 1142339308 ecr 0], length 0
18:38:54.851139 IP 92-184-144-1.mobile.fr.orangecustomers.net.60592 >
legendre.systella.fr.rtsp: Flags [S], seq 2252270373, win 63664, options
[mss 1384,sackOK,eol], length 0
18:38:55.251918 IP 92-184-144-1.mobile.fr.orangecustomers.net.60592 >
legendre.systella.fr.rtsp: Flags [R.], seq 2252270374, ack 0, win 0,
length 0
18:39:42.474479 IP 92-184-144-1.mobile.fr.orangecustomers.net.34148 >
legendre.systella.fr.rtsp: Flags [S], seq 3843575658, win 63664, options
[mss 1384,nop,wscale 8,sackOK,TS val 1142387329 ecr 0], length 0
18:39:42.873345 IP 92-184-144-1.mobile.fr.orangecustomers.net.34148 >
legendre.systella.fr.rtsp: Flags [S], seq 3843575658, win 63664, options
[mss 1384,nop,wscale 8,sackOK,TS val 1142387729 ecr 0], length 0
18:39:43.273207 IP 92-184-144-1.mobile.fr.orangecustomers.net.34148 >
legendre.systella.fr.rtsp: Flags [S], seq 3843575658, win 63664, options
[mss 1384,nop,wscale 8,sackOK,TS val 1142388129 ecr 0], length 0
18:39:43.673883 IP 92-184-144-1.mobile.fr.orangecustomers.net.34148 >
legendre.systella.fr.rtsp: Flags [S], seq 3843575658, win 63664, options
[mss 1384,sackOK,eol], length 0
18:39:44.073355 IP 92-184-144-1.mobile.fr.orangecustomers.net.34148 >
legendre.systella.fr.rtsp: Flags [R.], seq 3843575659, ack 0, win 0,
length 0

	Thus my server doesn't answer. But why 554/TCP appears to be open ?

	Regards,

	JB

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQQj8MW8iOsC2RXEznnFW/s/mMLXCAUCapBo+wAKCRDFW/s/mMLX
CNV/AQCEf/NK6TPv9JKwW6gF9kuGzuzs0W/7tTCy1gkNhr7FEgD8CTh5ZHkmSsRg
JR5+DiC+FRHOjsT0yfZwXDXtj0EZ5gE=
=6foo
-----END PGP SIGNATURE-----