Administrace komentářů

> Now I see log entries like:
> 
> ip_ct_tcp: invalid packet ignored IN= OUT= SRC=a.b.c.d DST=x.y.z.q LEN=48 
> TOS=0x00 PREC=0x00 TTL=118 ID=57462 DF PROTO=TCP SPT=2745 DPT=110 
> SEQ=1241333208 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B401010402)
> (most of them have SYN flag)
> 
> Interesting thing is that these log entries do not match those logged by
> iptables -t filter -A INPUT -m state --state INVALID -j LOG
> 
> Can someone tell why these two logs do not match, and what happens with 
> packets logged by (ip_ct_tcp) ip_conntrack_log_invalid?

TCP conntrack tries very hard to keep track of the connections.

The packets which are logged as 'invalid packet ignored' looks to 
conntrack as invalid, because it holds a connections and the packet does 
not fit into the stream. But at the same time it might be that conntrack 
holds a dead connection and the packet is a real, new, 
connection-initiating packet (SYN flag is on). So conntrack ignores the 
seemingly invalid packet, flags it as 'ESTABLISHED' (not 'INVALID') and 
lets it through. The reply packet will tell conntrack what should it do: 
delete the old dead connection or keep it as real.

ip_conntrack_log_invalid logs the "magic", which can help to identify
possible problems in TCP connection tracking: ignored packets or packets 
dropped by conntrack itself. All else is flagges as NEW, ESTABLISHED, 
RELATED or INVALID.