Re: DNS replies not RELATED/ESTABLISHED?
martin f krafft wrote:
also sprach Blair Strang <firstname.lastname@example.org> [2005.03.15.1245 +0100]:
I am guessing the problem is elsewhere. What does
/proc/net/ip_conntrack say the kernel is expecting?
The UDP "connection" is not listed. Someone else told me in private
mail that DNS is special, but I do not see anything special about
16:27:15.369276 18.104.22.168.62406 > 22.214.171.124.53: 21533+ A? debian.org. (28) (DF)
16:27:15.424481 126.96.36.199.53 > 188.8.131.52.62406: 21533 1/0/0 A 184.108.40.206 (44)
The corresponding ip_contrack entry:
udp 17 27 src=220.127.116.11 dst=18.104.22.168 sport=62406
dport=53 packets=1 bytes=67 src=22.214.171.124 dst=126.96.36.199
sport=53 dport=62406 packets=1 bytes=115 mark=0 use=1
This looks all good and fine. Whenever I get log entries generated
by iptables, it seems that they are some sort of spurious responses
by the servers, or else iptables would let them through.
Of course right now there aren't any. However, I have seen this for
years and always wondered...
Sorry I didn't understand from your original post that this was
only happening occasionally. Duh! Perhaps look into ip_conntrack_max?
Conntrack stress can be triggered by an nmap scan, heavy worm traffic,
low memory, very busy fw etc etc.
[WARNING: A meme virus was detected in this signature. It has been
cleaned by MemeSweeper(tm) 4.0]