[Oisf-users] Packets stucked in Nfqueue when running inline

Fernando Ortiz fernando.ortiz.f at gmail.com
Thu Aug 18 21:47:46 UTC 2011


Yes, but neither gre nor ppp (at least during these last tests, when I first
open this threat suricata was in another place where there was gre) Here
there are ip in ip tunnels.
Remember also that packets that I don't get stuck packets when I run only
one queue.

> As the message is not systematic, it may be tcp stream related.

I did not understand  the message is not systematic part. Could you explain
it a little please?

Also, the message logged says some packets are being dropped
>> (TmqhOutputPacketpool) -- Packet 0x3e54f20 has been outed without
verdict, dropping it

I checked the code, and I couldn't find any part where a packet gets
dropped.

2011/8/18 Eric Leblond <eric at regit.org>

> Hi,
>
> On Thu, 2011-08-18 at 13:07 -0500, Fernando Ortiz wrote:
> > These are some of the thousand warnings.
> >
> >
> > [27240] 18/8/2011 -- 12:57:22 - (tmqh-packetpool.c:165) <Info>
> > (TmqhOutputPacketpool) -- Packet 0x3dc33e0 has been outed without
> > verdict, dropping it
>
> Are you using something like gre or ppp tunel through the box ?
>
> The message appears in the tunnel related code. I've introduced it in
> the latest patch 'IPS: be sure to destroy packet when cleaning'. I don't
> know well this part of the code. Suricata is using internally a
> "pseudopacket" in two cases, tunnel or tcp stream reassembly in inline
> mode. As the message is not systematic, it may be tcp stream related.
>
> BR,
>
> > [27240] 18/8/2011 -- 12:57:22 - (source-nfq.c:932) <Warning>
> > (NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to
> > issue verdict on 302469
> > [27228] 18/8/2011 -- 12:57:22 - (source-nfq.c:701) <Warning>
> > (NFQRecvPkt) -- [ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error
> > -1: 0:Success
> > [27240] 18/8/2011 -- 12:57:22 - (tmqh-packetpool.c:165) <Info>
> > (TmqhOutputPacketpool) -- Packet 0x3e54f20 has been outed without
> > verdict, dropping it
> > [27240] 18/8/2011 -- 12:57:22 - (source-nfq.c:932) <Warning>
> > (NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to
> > issue verdict on 302485
> > [27227] 18/8/2011 -- 12:57:22 - (source-nfq.c:701) <Warning>
> > (NFQRecvPkt) -- [ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error
> > -1: 0:Success
> > [27240] 18/8/2011 -- 12:57:23 - (tmqh-packetpool.c:165) <Info>
> > (TmqhOutputPacketpool) -- Packet 0x2e223c0 has been outed without
> > verdict, dropping it
> > [27240] 18/8/2011 -- 12:57:23 - (source-nfq.c:932) <Warning>
> > (NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to
> > issue verdict on 304279
> > [27228] 18/8/2011 -- 12:57:23 - (source-nfq.c:701) <Warning>
> > (NFQRecvPkt) -- [ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error
> > -1: 0:Success
> > [27240] 18/8/2011 -- 12:57:23 - (tmqh-packetpool.c:165) <Info>
> > (TmqhOutputPacketpool) -- Packet 0x37a94e0 has been outed without
> > verdict, dropping it
> > [27240] 18/8/2011 -- 12:57:23 - (source-nfq.c:932) <Warning>
> > (NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to
> > issue verdict on 304696
> > [27228] 18/8/2011 -- 12:57:23 - (source-nfq.c:701) <Warning>
> > (NFQRecvPkt) -- [ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error
> > -1: 0:Success
> > [27240] 18/8/2011 -- 12:57:23 - (tmqh-packetpool.c:165) <Info>
> > (TmqhOutputPacketpool) -- Packet 0x37c09e0 has been outed without
> > verdict, dropping it
> > [27240] 18/8/2011 -- 12:57:23 - (source-nfq.c:932) <Warning>
> > (NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to
> > issue verdict on 304699
> > [27228] 18/8/2011 -- 12:57:23 - (source-nfq.c:701) <Warning>
> > (NFQRecvPkt) -- [ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error
> > -1: 0:Success
> > [27240] 18/8/2011 -- 12:57:23 - (tmqh-packetpool.c:165) <Info>
> > (TmqhOutputPacketpool) -- Packet 0x3f2f800 has been outed without
> > verdict, dropping it
> > [27240] 18/8/2011 -- 12:57:23 - (source-nfq.c:932) <Warning>
> > (NFQSetVerdictRescue) -- [ERRCODE: UNKNOWN_ERROR(77)] - trying to
> > issue verdict on 305025
> > [27228] 18/8/2011 -- 12:57:23 - (source-nfq.c:701) <Warning>
> > (NFQRecvPkt) -- [ERRCODE: UNKNOWN_ERROR(76)] - nfq_handle_packet error
> > -1: 0:Success
> >
> >
> > Hope it helps.
> >
> > 2011/8/18 Fernando Ortiz <fernando.ortiz.f at gmail.com>
> >         Sure, I will test that patch right now. I have on question.
> >         The warning says it is dropping packets.
> >
> >         (TmqhOutputPacketpool) -- Packet 0x4baa760 has been outed
> >         without verdict, dropping it
> >
> >
> >         There are a lot of this messages. I am a little worried about
> >         too many drops although nobody has complaint in the network.
> >         Why exactly are these drops about?
> >
> >
> >
> >
> >         2011/8/18 Eric Leblond <eric at regit.org>
> >
> >                 Hi,
> >
> >                 On Thu, 2011-08-18 at 12:22 -0500, Fernando Ortiz
> >                 wrote:
> >                 > All right. Now it is compiled and running.
> >                 >
> >                 >
> >                 > Got several of these messages
> >                 >
> >                 >
> >                 > [19643] 18/8/2011 -- 12:07:11 -
> >                 (tmqh-packetpool.c:165) <Info>
> >                 > (TmqhOutputPacketpool) -- Packet 0x4baa760 has been
> >                 outed without
> >                 > verdict, dropping it
> >                 > [19643] 18/8/2011 -- 12:07:11 - (source-nfq.c:929)
> >                 <Warning>
> >                 > (NFQSetVerdictRescue) -- [ERRCODE:
> >                 UNKNOWN_ERROR(77)] - trying to
> >                 > issue verdict on 55786
> >                 > [19631] 18/8/2011 -- 12:07:11 - (source-nfq.c:698)
> >                 <Warning>
> >                 > (NFQRecvPkt) -- [ERRCODE: UNKNOWN_ERROR(76)] -
> >                 nfq_handle_packet error
> >                 > -1
> >
> >
> >                 Ouah sexy ! nfq_handle_packet is returning in error
> >                 but the callback
> >                 function has not crashed (no message from her).
> >
> >                 Could you try with the atached patch ? It could help
> >                 to see what's going
> >                 on.
> >
> >                 BR
> >
> >
> >
> >
> >
> >
> >
> > --
> > Fernando Ortiz
> > Twitter: http://twitter.com/FernandOrtizF
> >
>
> --
> Eric Leblond
> Blog: http://home.regit.org/
>



-- 
Fernando Ortiz
Twitter: http://twitter.com/FernandOrtizF
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20110818/22d17432/attachment-0002.html>


More information about the Oisf-users mailing list