search for: sackok

Thanks for the tips, Tom. Here is the tcpdump -n output on the dmz computer - this gets repeated several times as the remote computer attempts to connect: 18:11:54.264580 66.113.134.243.55080 > 192.168.2.1.8082: S 3210481212:3210481212(0) win 5840 <mss 1460,sackOK,timestamp 65650966 0,nop,wscale 0> (DF) 18:11:54.264696 192.168.2.1.8082 > 66.113.134.243.55080: S 2765561851:2765561851(0) ack 3210481213 win 16060 <mss 1460,sackOK,timestamp 8845122 65650966,nop,wscale 0> (DF) 18:11:55.336674 192.168.2.1.8082 > 66.113.134.243.55036: S 2746570128:2...

...t gmail.com> --- Comment on attachment 134 --> https://bugzilla.netfilter.org/attachment.cgi?id=134 tcpdump of communication during which conntrack seems to "forget" packets 14:39:54.925957 IP Y.Y.Y.Y.1818 > X.X.X.X.2000: S 849153605:849153605(0) win 65535 <mss 1460,nop,nop,sackOK> 14:39:57.943185 IP Y.Y.Y.Y.1818 > X.X.X.X.2000: S 849153605:849153605(0) win 65535 <mss 1460,nop,nop,sackOK> 14:39:58.241750 IP X.X.X.X.2000 > Y.Y.Y.Y.1818: S 3217892892:3217892892(0) ack 849153606 win 15972 <mss 1452,nop,nop,sackOK> 14:39:58.242082 IP Y.Y.Y.Y.1818 > X.X.X....

...client (and vice versa) works fine. Looking at a tcpdump on the brick side I see the TCP handshake for the client. Looks strange because it is repeated after 1,2,4 seconds and so on 18:55:51.176832 IP cadmins101.49151 > cfilers201.24007: Flags [S], seq 3453818375, win 28364, options [mss 4052,sackOK,TS val 362061385 ecr 0,nop,wscale 7], length 0 18:55:51.176884 IP cfilers201.24007 > cadmins101.49151: Flags [S.], seq 1929363096, ack 3453818376, win 28280, options [mss 4052,sackOK,TS val 13791464 ecr 362061385,nop,wscale 7], length 0 18:55:51.179391 IP cadmins101.49149 > cfilers201.24007:...

...showing port 7777 is not blocked (I added an exception in IP tables) (Node 0) 13:13:11.711539 IP (tos 0x0, ttl 64, id 18286, offset 0, flags [DF], proto: TCP (6), length: 60) 10.128.7.33.47601 > 10.128.255.3.cbt: S, cksum 0xd272 (correct), 3820380795:3820380795(0) win 5840 <mss 1460,sackOK,timestamp 4294911253 0,nop,wscale 6> 13:13:14.710703 IP (tos 0x0, ttl 64, id 18287, offset 0, flags [DF], proto: TCP (6), length: 60) 10.128.7.33.47601 > 10.128.255.3.cbt: S, cksum 0xc6ba (correct), 3820380795:3820380795(0) win 5840 <mss 1460,sackOK,timestamp 4294914253 0,nop,wscale...

...9;'s what tcpdump shows: tcpdump for port 443: Not working access from inside the lan to the servers external Name / the servers external IP: => no connection ==================================== p54BE15A1.dip0.t-ipconnect.de.https: S 1859848764:1859848764(0) win 65535 <mss 1260,nop,nop,sackOK> 18:43:41.477631 IP lp-java.linkpool.3491 > p54BE15A1.dip0.t-ipconnect.de.https: S 1859848764:1859848764(0) win 65535 <mss 1260,nop,nop,sackOK> 18:43:41.479358 IP p54BE15A1.dip0.t-ipconnect.de.https > lp-java.linkpool.3491: R 0:0(0) ack 1859848765 win 0 18:43:41.967525 IP lp-java.lin...

...is some output from tcpdump. Any ideas? I have looked through the smb.conf and the logs but there is no mention of that ip address. 12:26:48.319216 DevServer1.practical.local.netbios-ssn > 192.168.192.1.3771: S [tcp sum ok] 2917805052:2917805052(0) ack 1513987244 win 5840 <mss 1460,nop,nop,sackOK> (DF) (ttl 64, id 0, len 48) 12:26:53.719201 DevServer1.practical.local.netbios-ssn > 192.168.192.1.3788: S [tcp sum ok] 3001783991:3001783991(0) ack 1839800344 win 5840 <mss 1460,nop,nop,sackOK> (DF) (ttl 64, id 0, len 48) 12:27:04.319217 DevServer1.practical.local.netbios-ssn > 192...

...46 winclient -> sambaserver ICMP Echo request (ID: 512 Sequence number: 20225) 87 0.00004 sambaserver -> winclient ICMP Echo reply (ID: 512 Sequence number: 20225) 88 0.00035 winclient -> sambaserver TCP D=445 S=4549 Syn Seq=416819196 Len=0 Win=64240 Options=<mss 1460,nop,nop,sackOK> 89 0.00004 sambaserver -> winclient TCP D=4549 S=445 Rst Ack=416819197 Win=0 91 0.01047 winclient -> sambaserver ICMP Echo request (ID: 512 Sequence number: 20481) 92 0.00004 sambaserver -> winclient ICMP Echo reply (ID: 512 Sequence number: 20481) 93 0.00039 winclie...

...n everytyhing works. Any ideas ? 07:38:15.480141 802.1Q vlan#911 P0 10.90.11.244.http > 10.90.11.1.47970: . ack 9 win 1098 (DF) 07:38:15.691074 802.1Q vlan#911 P0 10.10.0.27.34023 > 10.90.11.244.http: S 2715145345:2715145345(0) win 4380 <mss 1460,nop,wscale 0,nop,nop,timestamp 72820060 0,sackOK,eol> (DF) 07:38:15.691074 802.1Q vlan#902 P0 10.90.11.244.http > 10.10.0.27.34023: S 514059651:514059651(0) ack 2715145346 win 5808 <mss 1464,sackOK,timestamp 51754641 72820060,nop,wscale 2> (DF) 07:38:18.630101 802.1Q vlan#902 P0 10.90.11.244.http > 10.10.0.27.34023: S 514059651:514...

...eth0, link-type EN10MB (Ethernet), capture size 65535 bytes now I go to firefox and type the address to port 8000 and: 10:35:29.827739 IP 94.161.255.17.54042 > 178.79.148.185.8000: Flags [S], seq 121 406478, win 65535, options [mss 1380,nop,wscale 4,nop,nop,TS val 944767226 ecr 0 ,sackOK,eol], length 0 10:35:31.054375 IP 94.161.255.17.54042 > 178.79.148.185.8000: Flags [S], seq 121 406478, win 65535, options [mss 1380,nop,wscale 4,nop,nop,TS val 944768234 ecr 0 ,sackOK,eol], length 0 10:35:31.931012 IP 94.161.255.17.54042 > 178.79.148.185.8000: Flags [S...

...aserver ICMP Echo request (ID: 512 > Sequence number: 20225) > 87 0.00004 sambaserver -> winclient ICMP Echo reply (ID: 512 Sequence > number: 20225) > 88 0.00035 winclient -> sambaserver TCP D=445 S=4549 Syn > Seq=416819196 Len=0 Win=64240 Options=<mss 1460,nop,nop,sackOK> > 89 0.00004 sambaserver -> winclient TCP D=4549 S=445 Rst > Ack=416819197 Win=0 > 91 0.01047 winclient -> sambaserver ICMP Echo request (ID: 512 > Sequence number: 20481) > 92 0.00004 sambaserver -> winclient ICMP Echo reply (ID: 512 Sequence > number: 20...

...g to connect ukgate:~# tcpdump -nn port 80 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 19:21:59.735233 IP 10.0.0.4.1900 > 219.54.8.100.80: S 340139438:340139438(0) win 65535 <mss 1460,nop,nop,sackOK> 19:21:59.735396 IP 10.0.0.4.1901 > 213.73.201.11.80: S 340204029:340204029(0) win 65535 <mss 1460,nop,nop,sackOK> 19:22:01.734139 IP 10.0.0.4.1904 > 218.212.34.220.80: S 340860984:340860984(0) win 65535 <mss 1460,nop,nop,sackOK> 19:22:02.706327 IP 10.0.0.4.1900 > 219.54.8.1...

...e show params where recorded, iptables -t mangle -lnV shows no problem too. When I do telnet smtp.someisp.com 25, I see with tcpdump the packets going out through the interface ppp1 : 14:32:40.693429 62.212.120.196.34515 > 193.252.22.80.smtp: S 4069327741:4069327741(0) win 5808 <mss 1452,sackOK,timestamp 929359 0,nop,wscale 0> (DF) [tos 0x10] But the problem is that there are originated from 62.212.120.196, which is the ip of ppp0, not ppp1. So packets can''t take the way back. How can I change the "from" ip of packets that are routed through ppp1 ? Thanks for yo...

....0.1 02:02:28.314400 arp who-has asterix.armorica tell obelix.armorica 02:02:28.314480 arp reply asterix.armorica (0:c0:df:f0:4:78) is-at 0:c0:df:f0:4:78 (0:20:af:f8:18:60) 02:02:28.314828 obelix.armorica.iad3 > asterix.armorica.netbios-ssn: S 2203519:2203519(0) win 8192 <mss 1460,nop,nop,sackOK> (DF) 02:02:31.276085 obelix.armorica.iad3 > asterix.armorica.netbios-ssn: S 2203519:2203519(0) win 8192 <mss 1460,nop,nop,sackOK> (DF) 02:02:37.277635 obelix.armorica.iad3 > asterix.armorica.netbios-ssn: S 2203519:2203519(0) win 8192 <mss 1460,nop,nop,sackOK> (DF) 02:02:49.280...

...s: #tcpdump port 8080 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 15:07:21.522898 IP 158.226.150.44.musiconline > iacapp3.local.http-alt: S 3628241160:3628241160(0) win 64240 <mss 1460,nop,nop,sackOK> 15:07:24.440701 IP 158.226.150.44.musiconline > iacapp3.local.http-alt: S 3628241160:3628241160(0) win 64240 <mss 1460,nop,nop,sackOK> 15:07:30.456696 IP 158.226.150.44.musiconline > iacapp3.local.http-alt: S 3628241160:3628241160(0) win 64240 <mss 1460,nop,nop,sackOK> 3 pack...

...is is listening on eth1 as I try to SSH to the destination from an internal box (using lynx to connect to the same destination results in a web page): tcpdump: listening on eth1 07:13:12.614674 <Static IP>.37662 > <Dest IP>.ssh: S \ 2808907073:2808907073(0) win 5840 <mss1460,sackOK,timestamp \ 611570059 0,nop,wscale 0> (DF) 07:13:12.649772 <Dest IP>.ssh > <Static IP>.37662: S \ 2414052745:2414052745(0) \ ack 2808907074 win 65535 <mss 1400,nop,wscale \ 0,nop,nop,timestamp 2742813 611570059> (DF) 07:13:15.609403 <Static IP>.37662 &g...

...0 DROP all * * ::/0 ::/0 sudo tcpdump -i ens32 -n -vv ip or ip6 11:08:00.960362 IP6 (hlim 62, next-header TCP (6) payload length: 40) 2001:db8:2::2.57444 > 2001:db66:22::2.23: Flags [S], cksum 0xff54 (correct), seq 855240622, win 28800, options [mss 1440,sackOK,TS val 2398100706 ecr 0,nop,wscale 7], length 0 11:08:01.966189 IP6 (hlim 62, next-header TCP (6) payload length: 40) 2001:db8:2::2.57444 > 2001:db66:22::2.23: Flags [S], cksum 0xfe5a (correct), seq 855240622, win 28800, options [mss 1440,sackOK,TS val 2398100956 ecr 0,nop,wscale 7], length 0 11...

...ear to indicate that the server in the colo facility is receiving the SYN packets. What possible reasons are there that it would not reply with SYN+ACK? -------------- next part -------------- 19:08:43.751579 IP officefw.57948 > remoteserver.ssh: S 3347102294:3347102294(0) win 5840 <mss1460,sackOK,timestamp 2705398041 0,nop,wscale 7> 19:08:46.751136 IP officefw.57948 > remoteserver.ssh: S 3347102294:3347102294(0) win 5840 <mss1460,sackOK,timestamp 2705401041 0,nop,wscale 7> 19:08:52.749305 IP officefw.57948 > remoteserver.ssh: S 3347102294:3347102294(0) win 5840 <mss1460,sa...

...B (Ethernet), capture size 96 bytes 09:07:03.606045 00:11:43:fd:4d:ca > 00:00:f4:c3:9d:ac, ethertype IPv4 (0x0800), length 74: IP (tos 0x0, ttl 64, id 46520, offset 0, flags [DF], length: 60) 192.168.0.150.35238 > 65.40.217.150.443: S [tcp sum ok] 353484362:353484362(0) win 5840 <mss 1460,sackOK,timestamp 3624012786 0,nop,wscale 2> 0x0000: 0000 f4c3 9dac 0011 43fd 4dca 0800 4500 ........C.M...E. 0x0010: 003c b5b8 4000 4006 a906 c0a8 0096 4128 .<..@.@.......A( 0x0020: d996 89a6 01bb 1511 be4a 0000 0000 a002 .........J...... 0x0030: 16d0 1286 0000...

...11:44.141790 192.168.1.2.1027 > 192.168.1.5.netbios-ssn: . ack 429 win 7371 (DF) And a good one: [root@robert root]# more smbgood.txt [root@robert root]# tcpdump: listening on eth1 22:13:07.576710 192.168.1.2.1032 > 192.168.1.5.netbios-ssn: S 243664:243664(0) win 8192 <mss 1460,nop,nop,sackOK> (DF) 22:13:07.576978 192.168.1.5.netbios-ssn > 192.168.1.2.1032: S 858133472:858133472(0) ack 2436 65 win 5840 <mss 1460,nop,nop,sackOK> (DF) 22:13:07.577091 192.168.1.2.1032 > 192.168.1.5.netbios-ssn: . ack 1 win 8760 (DF) 22:13:07.577109 192.168.1.2.1032 > 192.168.1.5.netbios...

...oot@firewall ~]# tcpdump -i eth0 port 80 -nn tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 07:43:59.501397 IP 192.168.1.222.2867 > 66.249.93.104.80: S 2326997538:2326997538(0) win 5840 <mss 1460,sackOK,timestamp 6219115 0,nop,wscale 0> 07:44:02.495748 IP 192.168.1.222.2867 > 66.249.93.104.80: S 2326997538:2326997538(0) win 5840 <mss 1460,sackOK,timestamp 6219415 0,nop,wscale 0> 07:44:08.496618 IP 192.168.1.222.2867 > 66.249.93.104.80: S 2326997538:2326997538(0) win 5840 <mss 146...