Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Weird problem with system states

    Scheduled Pinned Locked Moved 1.2.3-PRERELEASE-TESTING snapshots - RETIRED
    32 Posts 6 Posters 9.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Hugovsky
      last edited by

      My states shows what's in the picture. My only connected computer is my macbook. Despite the number, states shown on the page don't seem to be more than 40 ou 50.

      pf.jpg
      pf.jpg_thumb

      1 Reply Last reply Reply Quote 0
      • H
        Hugovsky
        last edited by

        A virus was my first guess. I've tryed all computers shut down and use freenas console to connect to pfsense and it's the same. Something is creating states… It started with the fresh install of http://snapshots.pfsense.org/FreeBSD_RELENG_7_2/pfSense_RELENG_1_2/updates/pfSense-Full-Update-1.2.3-20090612-0600.tgz

        Would it help if I posted complete log with ip?

        1 Reply Last reply Reply Quote 0
        • jimpJ
          jimp Rebel Alliance Developer Netgate
          last edited by

          What do your WAN rules look like?

          You didn't do something crazy like put an allow all rule on the WAN did you? That would also cause abnormally high states because every packet that hits the WAN from some random IP will also get a state.

          Would only take one good port scan to get you up very high.

          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          1 Reply Last reply Reply Quote 0
          • R
            ryates
            last edited by

            There is a states problem on my box as well, 1.2.3-RC2 built on Sat Jun 13 09:44:26 EDT 2009.

            States climb to over the 10000 limit for no reason.  Bug it seems.

            ryts

            1 Reply Last reply Reply Quote 0
            • H
              Hugovsky
              last edited by

              @jimp:

              What do your WAN rules look like?

              You didn't do something crazy like put an allow all rule on the WAN did you? That would also cause abnormally high states because every packet that hits the WAN from some random IP will also get a state.

              Would only take one good port scan to get you up very high.

              No, I did not messed with wan rules. It's a clean install. Just added snort.

              1 Reply Last reply Reply Quote 0
              • H
                Hugovsky
                last edited by

                I'll put here my log. If I shouldn't, please say or remove it.

                icmp.txt

                1 Reply Last reply Reply Quote 0
                • C
                  clarknova
                  last edited by

                  That file shows 825 states. Some of them are icmp, others look like DNS requests (53), and the remainder to web sites (80 & 443), mostly google and pfsense-related sites.

                  Nothing really out of the ordinary there. The file with 11000 states would be more informative if it happens again. csv formatted would help too.

                  db

                  db

                  1 Reply Last reply Reply Quote 0
                  • H
                    Hugovsky
                    last edited by

                    Ok. I'll post it asap.

                    1 Reply Last reply Reply Quote 0
                    • H
                      Hugovsky
                      last edited by

                      Can't past more than 1000 lines to excel…. hummm..... strange problem. Anyway, here are the pictures. more than 9000. I'm just surfing the net. Have msn connected. And 3 tabs including this one. It seems to be a diferent number of states shown in the shell. Can I send you some log file or something?

                      pf1.jpg
                      pf1.jpg_thumb
                      pf.jpg
                      pf.jpg_thumb

                      1 Reply Last reply Reply Quote 0
                      • H
                        Hugovsky
                        last edited by

                        12601…

                        pf.jpg
                        pf.jpg_thumb

                        1 Reply Last reply Reply Quote 0
                        • H
                          Hugovsky
                          last edited by

                          I'm at 15004. Well, it seems that the problem with the lines is not in excel. The page that displays states, only shows 1000 lines. I've mailed the page to you clarknova. Sorry for that.

                          1 Reply Last reply Reply Quote 0
                          • C
                            clarknova
                            last edited by

                            No worries. Here's the csv of the first 1000 lines for public scrutiny. At first glance I see a lot of DNS traffic, a lot of connections to an IP address registered to Scott Ullrich, and connections to a machine on your LAN at port 443. Are you running a web server (https/ssl)?

                            Apparently I can't attach csv, so here's the csv file renamed as a txt.

                            With a couple people reporting this and both using 1.2.3-RC2, I wonder if it isn't a bug. Another thought looking at the csv is that there appear to be a lot of repeat entries, like connections are being multiplied.

                            I think one of you should file a bug report. See the link at the top of the forum pages.

                            db

                            states-pfsense.txt

                            db

                            1 Reply Last reply Reply Quote 0
                            • H
                              Hugovsky
                              last edited by

                              Yes. It's like if the firewall doesn't kill old connections. the 443 port is probably the connection to pfsense web server. I have no servers running. Only pfsense and 1 macbook. It's a home network. 192.168.50.1 is pfsense ip. 192.168.50.30 my macbook.  212.55.154.174, 212.55.154.190 my isp dns's.

                              1 Reply Last reply Reply Quote 0
                              • R
                                ryates
                                last edited by

                                @clarknova:

                                I think one of you should file a bug report. See the link at the top of the forum pages.

                                db

                                I must be blind  :) or one of my filters has kidnapped the link….. pray enlighten me....

                                IMO, the whole bug report process should be better advertised, as I have now searched and failed fool that I am...

                                ta,

                                ryts

                                1 Reply Last reply Reply Quote 0
                                • jimpJ
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by

                                  Can you try to recreate the problem without any packages installed?

                                  I'm curious to know if it happens on a stock system without any additions.

                                  Also, the bug reporting system is in the process of being moved to here:

                                  http://redmine.pfsense.org

                                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  1 Reply Last reply Reply Quote 0
                                  • jimpJ
                                    jimp Rebel Alliance Developer Netgate
                                    last edited by

                                    OK, nevermind, I can reproduce this now.

                                    Talked to another dev and he says it is likely from the recent (June 11th) patch for fixing multi-wan sticky connections and there is another patch to merge, but there is more testing to do first.

                                    So it should be fixed before too long, and if you roll back to a snap before June 11th you should be OK for now.

                                    Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                    Need help fast? Netgate Global Support!

                                    Do not Chat/PM for help!

                                    1 Reply Last reply Reply Quote 0
                                    • E
                                      eri--
                                      last edited by

                                      Upgrade to a snapshot more recent than this post and it should start to behave ok.

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        Hugovsky
                                        last edited by

                                        1.2.3-RC2
                                        built on Sun Jun 14 00:15:01 EDT 2009

                                        Same problem.

                                        1 Reply Last reply Reply Quote 0
                                        • jimpJ
                                          jimp Rebel Alliance Developer Netgate
                                          last edited by

                                          That snapshot is from early this morning, a new one has not yet been made.

                                          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                          Need help fast? Netgate Global Support!

                                          Do not Chat/PM for help!

                                          1 Reply Last reply Reply Quote 0
                                          • H
                                            Hugovsky
                                            last edited by

                                            @jimp:

                                            OK, nevermind, I can reproduce this now.

                                            Talked to another dev and he says it is likely from the recent (June 11th) patch for fixing multi-wan sticky connections and there is another patch to merge, but there is more testing to do first.

                                            So it should be fixed before too long, and if you roll back to a snap before June 11th you should be OK for now.

                                            I'll wait for 1 more update. If it doesn't get fixed, I'll roll back. Thx all for the answers.

                                            @jimp: Yes, I know. I've tryed it now just to see if it was already fixed. ;)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.