Sophos Firewall

Discussions Could not associate packet to any connection

Sophos Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 5 replies
Subscribers 28 subscribers
Views 13028 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Could not associate packet to any connection

Ralph Dekkers over 7 years ago

Hello all,

We have a strange problem.

When connecting to the sites of a client (peugeot.nl citroen.nl dsautomobiles.nl) we receive a ERR_CONNECTION_RESET in chrome.

When enabling logging and looking into the log. I see a the following line:

2018-03-06 21:00:02

Invalid Traffic

Denied

0

172.16.20.1

136.243.12.72

50303

80

TCP

0

01001

Open PCAP

Could not associate packet to any connection.

We had this problem with firmware 17.03 so I just upgraded to 17.05. But this did not solve the problem.

Anybody ideas.

This thread was automatically locked due to age.

Parents

0 rfcat_vk over 7 years ago

Hi,

no this is not a problem with the XG version. The ability to see these packets was added in mr-3, you can disable that if you wish, in system services -> log settings. There is also change to packet timeout which is supposed to reduce the incidence of those type entries in the log, in my case there was no change.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 SteveChung over 7 years ago in reply to rfcat_vk

I found many similar Invalid packet Denied log in my XG UTM as well.

Most of them are traffic to TCP 80.

I does not have IPS nor web filter enabled.

Why we should ignore and disable the logging?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to SteveChung

It is only for the invalid packets. Are you going to investigate the entries if not you are best off disabling reporting?

Ian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 rfcat_vk over 7 years ago in reply to SteveChung

It is only for the invalid packets. Are you going to investigate the entries if not you are best off disabling reporting?

Ian
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 SteveChung over 7 years ago in reply to rfcat_vk

I am wondering why there's so many invalid packet to port 80 denied by the firewall.

Does it mean the established connection was unstable?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to SteveChung

My simple understanding is for the internal devices one of the devices in the connection has dropped the connection and the other ed has failed to recognise that.

Where I have difficulty with the log entries is the number of entries showing that someone or something is trying to use my XG as http relay.

Ian
Cancel
Vote Up 0 Vote Down

Cancel