[Oisf-users] Packets stucked in Nfqueue when running inline

[Fernando Ortiz]

These are some of the thousand warnings.

[27240] 18/8/2011 -- 12:57:22 - (tmqh-packetpool.c:165) <Info>
(TmqhOutputPacketpool) -- Packet 0x3dc33e0 has been outed without verdict,
dropping it
[27240] 18/8/2011 -- 12:57:22 - (source-nfq.c:932) <Warning>
(NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to issue
verdict on 302469
[27228] 18/8/2011 -- 12:57:22 - (source-nfq.c:701) <Warning> (NFQRecvPkt) --
[ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error -1: 0:Success
[27240] 18/8/2011 -- 12:57:22 - (tmqh-packetpool.c:165) <Info>
(TmqhOutputPacketpool) -- Packet 0x3e54f20 has been outed without verdict,
dropping it
[27240] 18/8/2011 -- 12:57:22 - (source-nfq.c:932) <Warning>
(NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to issue
verdict on 302485
[27227] 18/8/2011 -- 12:57:22 - (source-nfq.c:701) <Warning> (NFQRecvPkt) --
[ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error -1: 0:Success
[27240] 18/8/2011 -- 12:57:23 - (tmqh-packetpool.c:165) <Info>
(TmqhOutputPacketpool) -- Packet 0x2e223c0 has been outed without verdict,
dropping it
[27240] 18/8/2011 -- 12:57:23 - (source-nfq.c:932) <Warning>
(NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to issue
verdict on 304279
[27228] 18/8/2011 -- 12:57:23 - (source-nfq.c:701) <Warning> (NFQRecvPkt) --
[ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error -1: 0:Success
[27240] 18/8/2011 -- 12:57:23 - (tmqh-packetpool.c:165) <Info>
(TmqhOutputPacketpool) -- Packet 0x37a94e0 has been outed without verdict,
dropping it
[27240] 18/8/2011 -- 12:57:23 - (source-nfq.c:932) <Warning>
(NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to issue
verdict on 304696
[27228] 18/8/2011 -- 12:57:23 - (source-nfq.c:701) <Warning> (NFQRecvPkt) --
[ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error -1: 0:Success
[27240] 18/8/2011 -- 12:57:23 - (tmqh-packetpool.c:165) <Info>
(TmqhOutputPacketpool) -- Packet 0x37c09e0 has been outed without verdict,
dropping it
[27240] 18/8/2011 -- 12:57:23 - (source-nfq.c:932) <Warning>
(NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to issue
verdict on 304699
[27228] 18/8/2011 -- 12:57:23 - (source-nfq.c:701) <Warning> (NFQRecvPkt) --
[ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error -1: 0:Success
[27240] 18/8/2011 -- 12:57:23 - (tmqh-packetpool.c:165) <Info>
(TmqhOutputPacketpool) -- Packet 0x3f2f800 has been outed without verdict,
dropping it
[27240] 18/8/2011 -- 12:57:23 - (source-nfq.c:932) <Warning>
(NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to issue
verdict on 305025
[27228] 18/8/2011 -- 12:57:23 - (source-nfq.c:701) <Warning> (NFQRecvPkt) --
[ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error -1: 0:Success

Hope it helps.

2011/8/18 Fernando Ortiz <fernando.ortiz.f at gmail.com>

> Sure, I will test that patch right now. I have on question. The warning
> says it is dropping packets.
>
> (TmqhOutputPacketpool) -- Packet 0x4baa760 has been outed without verdict,
> dropping it
>
> There are a lot of this messages. I am a little worried about too many
> drops although nobody has complaint in the network. Why exactly are these
> drops about?
>
>
>
> 2011/8/18 Eric Leblond <eric at regit.org>
>
>> Hi,
>>
>> On Thu, 2011-08-18 at 12:22 -0500, Fernando Ortiz wrote:
>> > All right. Now it is compiled and running.
>> >
>> >
>> > Got several of these messages
>> >
>> >
>> > [19643] 18/8/2011 -- 12:07:11 - (tmqh-packetpool.c:165) <Info>
>> > (TmqhOutputPacketpool) -- Packet 0x4baa760 has been outed without
>> > verdict, dropping it
>> > [19643] 18/8/2011 -- 12:07:11 - (source-nfq.c:929) <Warning>
>> > (NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to
>> > issue verdict on 55786
>> > [19631] 18/8/2011 -- 12:07:11 - (source-nfq.c:698) <Warning>
>> > (NFQRecvPkt) -- [ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error
>> > -1
>>
>> Ouah sexy ! nfq_handle_packet is returning in error but the callback
>> function has not crashed (no message from her).
>>
>> Could you try with the atached patch ? It could help to see what's going
>> on.
>>
>> BR
>>
>>


-- 
Fernando Ortiz
Twitter: http://twitter.com/FernandOrtizF
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20110818/4782d02b/attachment-0002.html>