Marc Lehmann wrote:
> On Wed, Sep 07, 2005 at 02:39:20PM +0200, Patrick McHardy <[EMAIL PROTECTED]>
> wrote:
>
>>Please try if loading the ipt_LOG module and executing
>>"echo 255 > /proc/sys/net/ipv4/netfilter/ip_conntrack_log_invalid"
>>gives more information
>
> Some more messages I get when logging is enabled:
>
> printk: 1286 messages suppressed.
> ip_ct_tcp: invalid state IN= OUT= SRC=84.56.231.206 DST=xxx.xxx.xxx.xxx
> LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=3260 DF PROTO=TCP SPT=41535 DPT=119
> SEQ=3475818900 ACK=1819416201 WINDOW=12198 RES=0x00 ACK URGP=0 OPT
> (0101080A00F5DE260917B744) UID=0
> printk: 1166 messages suppressed.
This doesn't tell much since we don't know what happend to the
connection before. You can disable message surpressing by echoing
0 to /proc/sys/net/core/message_cost. I had a beer too much for
serious debugging, just to give some hints, does this patch make
the problem go away?
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -843,7 +843,6 @@ static int tcp_error(struct sk_buff *skb
if (LOG_INVALID(IPPROTO_TCP))
nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
"ip_ct_tcp: bad TCP checksum ");
- return -NF_ACCEPT;
}
/* Check TCP flags. */
