On Apr 11, 2005 9:51 AM, Aleksandar Milivojevic <amilivojevic@xxxxxx> wrote: > Aleksandar Milivojevic wrote: > Oh, and BTW, the above tells me (based on IP addresses) there is > (probably) an NAT firewall doing DNAT before that packet hit the > firewall on your mail server. It might be that something got blocked on > that upstream NAT firewall. Another thing that I haven't mentioned in > my previous mail is that you might have blocked some ICMP traffic that > shouldn't be blocked (either on the machine in question or on the > upstream NAT firewall). > Thanks Aleksandar, Yes, there is an upstream NAT firewall. There are very limited ports open on there. I'm pretty sure it's open to all ICMP traffic, but I'll have to go back in and double check when I'm on site again later this afternoon. I left ethereal running overnight and caught several packets that were tripping this log event. Out of the 7 events that I caught, 6 of them showed [TCP ZeroWindow] and [INCORRECT CHECKSUM] in the packet info. There are other places where I would see the ZeroWindow message that did not trip the log, but there were no other places where I would see the INCORRECT CHECKSUM. The seventh entry that showed up in the log did not have an info line that matched either the ZeroWindow or Checksum message, but it was the last packet received from the host and the info simply stated: 4257 > smtp [RST] Seq=93 Ack=1545503494 Win=0 Len=0 I think I understand what you mean about seeing an RST AFTER Postfix closes the connection. Maybe I should look at what Postfix sends when it closes the connection. If Postfix sends the RST, then should the other end send anything back at all? Maybe an ACK? Does Netfilter simply look for the first RST (from either side) and then consider it a closed connection? The IPTables rules are set up to allow incoming connections on port 25 if the state is NEW. But I'm guessing that a new connection should not have the RST in it. I guess my concern is that I just want to make sure that I am not rejecting traffic that should be valid, and simply creating a rule to tell IPTables not to log the packet will only hide the issue. If it is truly a packet that can be disregarded then I have no problem with it, but I wanted to be sure. I'm also guessing that this issue is moving farther away from a Fedora issue, so I'll apologize to the list if this thread is straying. -- David Registered Linux User 383030 (since everyone else was doing it 8-) ----------------------------------------------------------------------- There are only 10 kinds of people in this world, those who understand binary, and those who don't.
