Re: Iptables find invalid packets

[Dimitri GOURDON <dgourdon@xxxxxxxxx>]

I will try but don't believe it :

I've reproduce the same behavior in my lab with only 1 client... so... I 
try  ;)

Dimitri

Bernhard Bock a écrit :
> Hi Dimitri,
>
> Dimitri GOURDON wrote:
> > A lot of TCP packets with FIN or RST flags (all I think) from clients 
> > are dropped by Iptables as state INVALID. The consequence is that I 
> > have a lot of connection in FIN_WAIT state (shown by netstat) on the 
> > 2 web servers...
> [...]
> > Is someone can help me ???
>
> Sounds a bit like the problem I've asked about a few days ago. Try to 
> increase the hashsize of nf_conntrack. My INVALID packets vanished 
> after this (at least as long as I wasn't using conntrackd for stateful 
> failover).
>
> best regards
> Bernhard

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html