Ack/Fin packets dropped.
Mon, 30 Jul 2001 10:52:35 -0700
-----BEGIN PGP SIGNED MESSAGE-----
On Monday 30 July 2001 10:41, Alexander Demenshin wrote:
> On Mon, Jul 30, 2001 at 07:30:10PM +0200, Patrick Schaaf wrote:
> > > Perhaps - but obviously not long enough. I have dozens of those log
> > > entries every day on my very low-traffic home firewall.
> > Do they demonstrably break functionality, or just make you nervous?
> Well, alternative to new "buttons" would be opportunity to filter those
> log entries (which, in turn, just pollute log files and it is easy to
> miss something important).
> Is there any filtering opportunity? I fear - no, though... On one of my
> systems (proxy) I see thousands of such entries every day, and this is
> not very busy proxy, BTW...
Well actually, yes...you can filter them. I have a similar problem with a
news outsource that performs load balancing and it often does the same thing.
The way I filter it is:
# flaky nntp server closes
iptables -A INPUT -i eth0 -s 207.126.96/19 -p tcp --tcp-flags \
ACK,FIN ACK,FIN --sport 119 -m string --string \
'closing connection - goodbye' -j ACCEPT
I suppose I could just drop it too.
Can anyone comment on the relative efficiency of the string match as compared
to other matching functions?
-----BEGIN PGP SIGNATURE-----
Comment: Keeping the world safe for geeks.
-----END PGP SIGNATURE-----