<![CDATA[Cleaning TCP: FA FPA RA logs. How to remove them from the logs?]]>Hello,

This is a recurring post but after trying several solutions (conservative + reboot, create a pass rule to not log), I am not able to get rid of these flood. I know it doesn't hurt the traffic and the FW but it's just annoying.

I created an explicitly rule to filter out those logs but it doesn't match for certain reason. Are they advanced options to check so I can filter out these packets?

Merci
Xavier

https://doc.pfsense.org/index.php/Why_do_my_logs_show_%22blocked%22_for_traffic_from_a_legitimate_connection

FWlogs.jpg
FWlogs.jpg_thumb
tcpdump.jpg
tcpdump.jpg_thumb
FWrule.jpg
FWrule.jpg_thumb
FWalias.jpg
FWalias.jpg_thumb

]]>https://forum.netgate.com/topic/124289/cleaning-tcp-fa-fpa-ra-logs-how-to-remove-them-from-the-logsRSS for NodeWed, 09 Sep 2026 00:21:17 GMTMon, 11 Dec 2017 15:43:53 GMT60<![CDATA[Reply to Cleaning TCP: FA FPA RA logs. How to remove them from the logs? on Sat, 16 Dec 2017 20:04:18 GMT]]>Sorry yes I should have specified:

  • The first letter is the VLAN tag: Untagged or Tagged

  • The second letter is the network: Cam, Lan or Wan

Thanks for asking @johnpoz

Therefore can I assume that my 'default rule' is OK for logging the Syn packets only?

]]>https://forum.netgate.com/post/741475https://forum.netgate.com/post/741475Sat, 16 Dec 2017 20:04:18 GMT<![CDATA[Reply to Cleaning TCP: FA FPA RA logs. How to remove them from the logs? on Sat, 16 Dec 2017 17:12:35 GMT]]>What is UW?  TL TC UL stand for?

]]>https://forum.netgate.com/post/741463https://forum.netgate.com/post/741463Sat, 16 Dec 2017 17:12:35 GMT<![CDATA[Reply to Cleaning TCP: FA FPA RA logs. How to remove them from the logs? on Fri, 15 Dec 2017 17:25:04 GMT]]>Thank you all. I have added the attached rule and since then it's very quiet which I like :)

Can you confirm that this the correct way to set the rule? (I have applied it in every interface).

FYI I don't think I have any asymmetric routing because of how my network is setup. I have added a picture for transparency.

Merci and have a nice WE! Santa Claus is coming :)

black1.jpg
black1.jpg_thumb
black2.jpg
black2.jpg_thumb
black3.jpg
black3.jpg_thumb
network.jpg
network.jpg_thumb

]]>https://forum.netgate.com/post/741343https://forum.netgate.com/post/741343Fri, 15 Dec 2017 17:25:04 GMT<![CDATA[Reply to Cleaning TCP: FA FPA RA logs. How to remove them from the logs? on Wed, 13 Dec 2017 13:01:28 GMT]]>If you are seeing a huge amount of out of state traffic - this would either point to an asymmetrical routing issue, or borked client.. I have seen android phones generate quite a bit of out of state.. But it wasn't constant.. Would be sporadic at best.. not constant flood of noise.

Seeing the out of state traffic can help you fix problems in your network.. I would suggest only turning off the default log rule if the out of state traffic is caused by some bad client and can not be fixed and the amount of noise is keeping you from seeing more interesting traffic your interested in.

kpa is correct many firewalls do not log out of state traffic out of the box.. Shoot the usg 3p that I have had some recent experience with doesn't even have a simple way to view any firewall logs ;)  Be it a syn block or out of state block.. They just do not show you any thing blocked by the firewall unless you specifically go looking for it, or take the time to send it to a syslog so you can view it..

But yes viewing everything can be sometimes overwhelming to new users watching the log.  Especially on the wan side - there is a shit ton of UDP noise that pretty much just noise if you ask me, which is why I only log tcp syn traffic.. Just interesting to see what ports are being attempted.. ssh, 1433, telnet, 3389 (rdp) and ftp are very very common bots and scripts looking for open shit they can try and access.

]]>https://forum.netgate.com/post/740888https://forum.netgate.com/post/740888Wed, 13 Dec 2017 13:01:28 GMT<![CDATA[Reply to Cleaning TCP: FA FPA RA logs. How to remove them from the logs? on Wed, 13 Dec 2017 11:44:47 GMT]]>The default logging is only there for you to take note of the amount of noise there is among regular TCP/IP traffic and then turn it off and write your own rules for more precise logging. PfSense is slightly different compared to other firewall distributions that by default hide that noise to put the user's mind at ease.

]]>https://forum.netgate.com/post/740870https://forum.netgate.com/post/740870Wed, 13 Dec 2017 11:44:47 GMT<![CDATA[Reply to Cleaning TCP: FA FPA RA logs. How to remove them from the logs? on Wed, 13 Dec 2017 10:33:52 GMT]]>Thank you both for the answers. I will therefore remove this rule and yes I had that in mind but after different readings I ended up trying :) but I agree it doesn't make sense to have rule if we are speaking about out of the state messages.

I may just do what johnpoz was proposing (turn off logging and activate it only for the SYN packets)

]]>https://forum.netgate.com/post/740865https://forum.netgate.com/post/740865Wed, 13 Dec 2017 10:33:52 GMT<![CDATA[Reply to Cleaning TCP: FA FPA RA logs. How to remove them from the logs? on Tue, 12 Dec 2017 21:11:54 GMT]]>As a rule of thumb, not sure if there are any exceptions, the rules you specific in the UI only apples to newly created states. Packets that are out of state will never hit your manually created rules.

]]>https://forum.netgate.com/post/740774https://forum.netgate.com/post/740774Tue, 12 Dec 2017 21:11:54 GMT<![CDATA[Reply to Cleaning TCP: FA FPA RA logs. How to remove them from the logs? on Mon, 11 Dec 2017 18:12:18 GMT]]>From you putting in a rule - its like you didn't read the link you posted too.. Those are out of state packets.. Your allow rule would not allow something that is out of state.

If you do not want to see out of state logged then turn off default logging.  Then create a block rule at the end of your lan rules that logs but only when SYN..

]]>https://forum.netgate.com/post/740561https://forum.netgate.com/post/740561Mon, 11 Dec 2017 18:12:18 GMT