FW 60001 - Default DROP - Hybrid Migration

Salut Benoit,

Notice that those are RST packets that are default dropped out of the INPUT chain.  This means that the connection tracker timed out on the connection and doesn't know what to do with the packet if it's allowed in.

This looks like traffic from England to you.  Maybe some TCP guru can tell us which ip_conntrack_tcp_timeout needs to be changed.

Cheers - Bob

I have been talking with support about similar data recently, and they have assured me that it can be ignored.   Here is what I think is happening:

1) UTM decides to close the connection and sends a Goodbye packet.

2) The remote device is supposed to send a Goodbye confirmation.   UTM doesn't care to wait around, so it moves on.

3) The remote goodbye packet is received.  UTM has already moved on, so the packet is unmatched to any open connection, and is dropped as noise.

I think this applies to anything with RST or FIN in the TCP Flags field.   I think most of my examples have had an ACK flag as well, but I am suspect the absence of an ACK in your data is not critical.

I have been talking with support about similar data recently, and they have assured me that it can be ignored.   Here is what I think is happening:

1) UTM decides to close the connection and sends a Goodbye packet.

2) The remote device is supposed to send a Goodbye confirmation.   UTM doesn't care to wait around, so it moves on.

3) The remote goodbye packet is received.  UTM has already moved on, so the packet is unmatched to any open connection, and is dropped as noise.

I think this applies to anything with RST or FIN in the TCP Flags field.   I think most of my examples have had an ACK flag as well, but I am suspect the absence of an ACK in your data is not critical.

I agree in general, Doug, but not when there's an associated lack of communication.  Sometimes there is a fire when there's smoke! [;)]

Cheers - Bob