PF source-track reports high number of connections (4294967254)

M

mkrzewic

Hi, what could cause an almost INT_MAX number of connections? :

Code: 
root@primus:~ # pfctl -s Sources
10.0.0.200 -> 0.0.0.0 ( states 33, connections 29, rate 0.0/0s )
10.0.0.201 -> 0.0.0.0 ( states 1, connections 1, rate 0.0/0s )
10.0.0.100 -> 0.0.0.0 ( states 3, connections 4294967254, rate 0.0/0s )

the rule that generates accounts for this is:
Code: 
pass in quick on igb0 from 10.0.0.100 to any flags S/SA keep state (max 3000, source-track rule, max-src-conn 800, adaptive.start 1800, adaptive.end 3600)

the machine in question is a smartphone, and I flushed the counter last night because of course the rule stops matching and the phone has no connection anymore. This started happening since I enabled source tracking after a youth flooded the network with bt traffic saturating the flimsy isp provided gateway.
The firewall is a 14.1-RELEASE-p5.
thanks,
Mikolaj
 
Hi, an update, is happens more often to the accounting of random machines on the network. I don't know how this accounting is done, but given that it looks like an unsigned int counter wrapping around maybe it is a missing check? race condition? Or is this intentional?
 
You must log in or register to reply here.
Back
Top