NetFilter
[Top] [All Lists]

Re: Conntrack rule timeout problem

To: Gáspár Lajos <swifty@freemail.hu>
Subject: Re: Conntrack rule timeout problem
From: Pat Riehecky <prieheck@iwu.edu>
Date: Thu, 24 May 2007 09:16:53 -0500
Cc: netfilter@lists.netfilter.org
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
In-reply-to: <46546B8B.9040705@freemail.hu>
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Organization: Illinois Wesleyan University
References: <1179765250.12001.18.camel@thales.lan> <465437E1.9030600@freemail.hu> <1179927731.28690.16.camel@thales.lan> <46546B8B.9040705@freemail.hu>
Sender: netfilter-bounces@lists.netfilter.org
That is an excellent article!

I attempted to simplify the oddities I am seeing to avoid being overly
complex, but it seems that was in error....

Here is a packet that was caught on its way out of my server, it cannot
be part of a FORWARD chain as my FORWARD chain looks like this

:FORWARD DROP [0:0]
-A FORWARD -j LOG --log-prefix "Default DROP (FORWARD): " 
-A FORWARD -j DROP 

Simply put the answer to any forward is "NO"

The packet is :
Default DROP (OUTPUT): IN= OUT=eth0 SRC=192.168.12.74 DST=66.28.242.99
LEN=344 TOS=0x00 PREC=0x00 TTL=64 ID=13688 DF PROTO=TCP SPT=60155 DPT=80
WINDOW=5840 RES=0x00 ACK FIN URGP=0

It tries for a while and then gives up.  This feels identical to the
input scenario.  The last packet seems to not be getting through as
RELATED/ESTABLISHED.  After studying the flow with iptstate 
(a bit poorly, but it was a start) this seems to occur when a connection
is closed - but not when all connections are closed.  This leads me to
believe that it has to be related to conntrack.

Is my reasoning on this flawed?
Pat

On Wed, 2007-05-23 at 18:27 +0200, Gáspár Lajos wrote:
> Pat Riehecky írta:
> > I am about 90% certain that I am not being scanned as a bunch of the
> > dropped packets are coming from places like the New York Times,
> > Microsoft, and Google.  Admittedly they could be spoofed IP addresses.
> > but the packets are all coming from 80 or 443 and they are all destined
> > for TCP Ports in the ephemeral range.  Additionally in my squid logs I
> > have a corresponding entry requesting data from that server.
> >
> >   
> Well... Read this:
> 
> http://www.hackinthebox.org/modules.php?op=modload&name=News&file=article&sid=10640&mode=thread&order=0&thold=0
> 
> The interesting part starts at *"Camouflaging your ip address"...*
> > All evidence I have points to some sort of conntrack timeout.
> > Occasionally I can find the IP addresses in the output from iptstate,
> > but... 
> >
> > Thanks for the ideas, any chance for more theories?
> > Pat
> >   
> Swifty
> 



<Prev in Thread] Current Thread [Next in Thread>