meaning of State-mismatch

[Aristedes Maniatis]

On 27/01/2015 6:46pm, Dimitry Andric wrote:
> On 27 Jan 2015, at 07:25, Aristedes Maniatis <ari at ish.com.au> wrote:
>>
>> I have been unable to find much documentation about the counter called "state-mismatch". I notice it going up on my firewall (FreeBSD 10.1) but only at a slow rate (maybe at around 1 per minute).
>>
>> What is the significance of this value? Is it indicative of dropped states (and I should be increasing the state timeout)?
> 
> It's not really documented in our pfctl(8) manpage, but the OpenBSD version does
> mention it:
> 
> state-mismatch
>            packet was associated with a state entry, but sequence numbers did not
>            match
> 
> So maybe something is dropping packets, making holes in the sequence numbers?  Or
> maybe somebody is trying something sneaky? :)
> 
> -Dimitry

Ah, thanks for that. Maybe you could add that doc to the FreeBSD man page. Could it simply be a packet loss issue where a packet is lost and the next packet arrives out of order?

Ari




-- 
-------------------------->
Aristedes Maniatis
ish
http://www.ish.com.au
Level 1, 30 Wilson Street Newtown 2042 Australia
phone +61 2 9550 5001   fax +61 2 9550 4001
GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A