On 27/01/2015 6:46pm, Dimitry Andric wrote: > On 27 Jan 2015, at 07:25, Aristedes Maniatis <a...@ish.com.au> wrote: >> >> I have been unable to find much documentation about the counter called >> "state-mismatch". I notice it going up on my firewall (FreeBSD 10.1) but >> only at a slow rate (maybe at around 1 per minute). >> >> What is the significance of this value? Is it indicative of dropped states >> (and I should be increasing the state timeout)? > > It's not really documented in our pfctl(8) manpage, but the OpenBSD version > does > mention it: > > state-mismatch > packet was associated with a state entry, but sequence numbers did > not > match > > So maybe something is dropping packets, making holes in the sequence numbers? > Or > maybe somebody is trying something sneaky? :) > > -Dimitry
Ah, thanks for that. Maybe you could add that doc to the FreeBSD man page. Could it simply be a packet loss issue where a packet is lost and the next packet arrives out of order? Ari -- --------------------------> Aristedes Maniatis ish http://www.ish.com.au Level 1, 30 Wilson Street Newtown 2042 Australia phone +61 2 9550 5001 fax +61 2 9550 4001 GPG fingerprint CBFB 84B4 738D 4E87 5E5C 5EFA EF6A 7D2E 3E49 102A _______________________________________________ freebsd-pf@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "freebsd-pf-unsubscr...@freebsd.org"
