Re: Iptables find invalid packets

[Bernhard Bock <mailinglists@xxxxxxx>]

Hi Dimitri,

Dimitri GOURDON wrote:
> A lot of TCP packets with FIN or RST flags (all I think) from clients 
> are dropped by Iptables as state INVALID. The consequence is that I have 
> a lot of connection in FIN_WAIT state (shown by netstat) on the 2 web 
> servers...
[...]
> Is someone can help me ???

Sounds a bit like the problem I've asked about a few days ago. Try to 
increase the hashsize of nf_conntrack. My INVALID packets vanished after 
this (at least as long as I wasn't using conntrackd for stateful failover).

best regards
Bernhard
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html