Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Weird problem with system states

    1.2.3-PRERELEASE-TESTING snapshots - RETIRED
    6
    32
    8770
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Hugovsky last edited by

      I'm having a problem with states table. Web interfave shows lots of them but, with pftop, everything seems right. Is it me or there's something wrong here?

      Last snapshot, full install, 512 MB p3 1000Mhz. Doing pppoe thru bridged router.



      1 Reply Last reply Reply Quote 0
      • C
        clarknova last edited by

        Have you clicked on the "show states" link to see what they are? 11000+ looks like a lot to me, but I only run pfsense at home. 11000 would be rather normal on a large network (and conceivable on even a simple home network with a bunch of torrents running). So what's your situation? What do the bulk of those states look like?

        db

        db

        1 Reply Last reply Reply Quote 0
        • H
          Hugovsky last edited by

          I've turned off all my computers. It's a home network. Before the update, states didn't pass 100-200. No torrents or downloads.

          I've updated to lastest snapshot, and the problem seems to have desappeared. 2009-06-13-0944.

          I have another pfsense box that serves 5 wireless access points for 300+ computers. In that box it's normal to have 9000-10000 states. But in my home, I've never saw it above 600. Anyway, it seems normal, now. if I get this again, I'll post it again.

          1 Reply Last reply Reply Quote 0
          • jimp
            jimp Rebel Alliance Developer Netgate last edited by

            As clarknova was saying, you need to go to Diagnostics > States, and view the state count/list there.

            Odds are, you had something on your network which was making a lot of connections (and Bittorrent will do this, among others), or something with a virus, etc.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • H
              Hugovsky last edited by

              My states shows what's in the picture. My only connected computer is my macbook. Despite the number, states shown on the page don't seem to be more than 40 ou 50.


              1 Reply Last reply Reply Quote 0
              • H
                Hugovsky last edited by

                A virus was my first guess. I've tryed all computers shut down and use freenas console to connect to pfsense and it's the same. Something is creating states… It started with the fresh install of http://snapshots.pfsense.org/FreeBSD_RELENG_7_2/pfSense_RELENG_1_2/updates/pfSense-Full-Update-1.2.3-20090612-0600.tgz

                Would it help if I posted complete log with ip?

                1 Reply Last reply Reply Quote 0
                • jimp
                  jimp Rebel Alliance Developer Netgate last edited by

                  What do your WAN rules look like?

                  You didn't do something crazy like put an allow all rule on the WAN did you? That would also cause abnormally high states because every packet that hits the WAN from some random IP will also get a state.

                  Would only take one good port scan to get you up very high.

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • R
                    ryates last edited by

                    There is a states problem on my box as well, 1.2.3-RC2 built on Sat Jun 13 09:44:26 EDT 2009.

                    States climb to over the 10000 limit for no reason.  Bug it seems.

                    ryts

                    1 Reply Last reply Reply Quote 0
                    • H
                      Hugovsky last edited by

                      @jimp:

                      What do your WAN rules look like?

                      You didn't do something crazy like put an allow all rule on the WAN did you? That would also cause abnormally high states because every packet that hits the WAN from some random IP will also get a state.

                      Would only take one good port scan to get you up very high.

                      No, I did not messed with wan rules. It's a clean install. Just added snort.

                      1 Reply Last reply Reply Quote 0
                      • H
                        Hugovsky last edited by

                        I'll put here my log. If I shouldn't, please say or remove it.

                        icmp.txt

                        1 Reply Last reply Reply Quote 0
                        • C
                          clarknova last edited by

                          That file shows 825 states. Some of them are icmp, others look like DNS requests (53), and the remainder to web sites (80 & 443), mostly google and pfsense-related sites.

                          Nothing really out of the ordinary there. The file with 11000 states would be more informative if it happens again. csv formatted would help too.

                          db

                          db

                          1 Reply Last reply Reply Quote 0
                          • H
                            Hugovsky last edited by

                            Ok. I'll post it asap.

                            1 Reply Last reply Reply Quote 0
                            • H
                              Hugovsky last edited by

                              Can't past more than 1000 lines to excel…. hummm..... strange problem. Anyway, here are the pictures. more than 9000. I'm just surfing the net. Have msn connected. And 3 tabs including this one. It seems to be a diferent number of states shown in the shell. Can I send you some log file or something?




                              1 Reply Last reply Reply Quote 0
                              • H
                                Hugovsky last edited by

                                12601…


                                1 Reply Last reply Reply Quote 0
                                • H
                                  Hugovsky last edited by

                                  I'm at 15004. Well, it seems that the problem with the lines is not in excel. The page that displays states, only shows 1000 lines. I've mailed the page to you clarknova. Sorry for that.

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    clarknova last edited by

                                    No worries. Here's the csv of the first 1000 lines for public scrutiny. At first glance I see a lot of DNS traffic, a lot of connections to an IP address registered to Scott Ullrich, and connections to a machine on your LAN at port 443. Are you running a web server (https/ssl)?

                                    Apparently I can't attach csv, so here's the csv file renamed as a txt.

                                    With a couple people reporting this and both using 1.2.3-RC2, I wonder if it isn't a bug. Another thought looking at the csv is that there appear to be a lot of repeat entries, like connections are being multiplied.

                                    I think one of you should file a bug report. See the link at the top of the forum pages.

                                    db

                                    states-pfsense.txt

                                    db

                                    1 Reply Last reply Reply Quote 0
                                    • H
                                      Hugovsky last edited by

                                      Yes. It's like if the firewall doesn't kill old connections. the 443 port is probably the connection to pfsense web server. I have no servers running. Only pfsense and 1 macbook. It's a home network. 192.168.50.1 is pfsense ip. 192.168.50.30 my macbook.  212.55.154.174, 212.55.154.190 my isp dns's.

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        ryates last edited by

                                        @clarknova:

                                        I think one of you should file a bug report. See the link at the top of the forum pages.

                                        db

                                        I must be blind  :) or one of my filters has kidnapped the link….. pray enlighten me....

                                        IMO, the whole bug report process should be better advertised, as I have now searched and failed fool that I am...

                                        ta,

                                        ryts

                                        1 Reply Last reply Reply Quote 0
                                        • jimp
                                          jimp Rebel Alliance Developer Netgate last edited by

                                          Can you try to recreate the problem without any packages installed?

                                          I'm curious to know if it happens on a stock system without any additions.

                                          Also, the bug reporting system is in the process of being moved to here:

                                          http://redmine.pfsense.org

                                          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                          Need help fast? Netgate Global Support!

                                          Do not Chat/PM for help!

                                          1 Reply Last reply Reply Quote 0
                                          • jimp
                                            jimp Rebel Alliance Developer Netgate last edited by

                                            OK, nevermind, I can reproduce this now.

                                            Talked to another dev and he says it is likely from the recent (June 11th) patch for fixing multi-wan sticky connections and there is another patch to merge, but there is more testing to do first.

                                            So it should be fixed before too long, and if you roll back to a snap before June 11th you should be OK for now.

                                            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                            Need help fast? Netgate Global Support!

                                            Do not Chat/PM for help!

                                            1 Reply Last reply Reply Quote 0
                                            • E
                                              eri-- last edited by

                                              Upgrade to a snapshot more recent than this post and it should start to behave ok.

                                              1 Reply Last reply Reply Quote 0
                                              • H
                                                Hugovsky last edited by

                                                1.2.3-RC2
                                                built on Sun Jun 14 00:15:01 EDT 2009

                                                Same problem.

                                                1 Reply Last reply Reply Quote 0
                                                • jimp
                                                  jimp Rebel Alliance Developer Netgate last edited by

                                                  That snapshot is from early this morning, a new one has not yet been made.

                                                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                                  Need help fast? Netgate Global Support!

                                                  Do not Chat/PM for help!

                                                  1 Reply Last reply Reply Quote 0
                                                  • H
                                                    Hugovsky last edited by

                                                    @jimp:

                                                    OK, nevermind, I can reproduce this now.

                                                    Talked to another dev and he says it is likely from the recent (June 11th) patch for fixing multi-wan sticky connections and there is another patch to merge, but there is more testing to do first.

                                                    So it should be fixed before too long, and if you roll back to a snap before June 11th you should be OK for now.

                                                    I'll wait for 1 more update. If it doesn't get fixed, I'll roll back. Thx all for the answers.

                                                    @jimp: Yes, I know. I've tryed it now just to see if it was already fixed. ;)

                                                    1 Reply Last reply Reply Quote 0
                                                    • R
                                                      ryates last edited by

                                                      Thanks for the info - I have been on Jun 11 17:41:59 EDT 2009 as a workaround.

                                                      small matter: the updater informs  the latest version as "Sun Jun 14 05:33:50 EDT 2009" yet it is in fact a build from 00:15:xx or so.  Why the mismatch in the version file?

                                                      1 Reply Last reply Reply Quote 0
                                                      • jimp
                                                        jimp Rebel Alliance Developer Netgate last edited by

                                                        @ryates:

                                                        Thanks for the info - I have been on Jun 11 17:41:59 EDT 2009 as a workaround.

                                                        small matter: the updater informs  the latest version as "Sun Jun 14 05:33:50 EDT 2009" yet it is in fact a build from 00:15:xx or so.  Why the mismatch in the version file?

                                                        Probably a mismatch of time zones, GMT vs. local time.

                                                        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                                        Need help fast? Netgate Global Support!

                                                        Do not Chat/PM for help!

                                                        1 Reply Last reply Reply Quote 0
                                                        • R
                                                          ryates last edited by

                                                          Ah yes, of course.  Devs might fix that, though it is trivial.

                                                          1 Reply Last reply Reply Quote 0
                                                          • B
                                                            Bern last edited by

                                                            I was having the problem with states during the week.

                                                            I've updated to:

                                                            1.2.3-RC2
                                                            built on Sun Jun 14 18:15:10 EDT 2009

                                                            and it looks like it's fixed now.

                                                            1 Reply Last reply Reply Quote 0
                                                            • jimp
                                                              jimp Rebel Alliance Developer Netgate last edited by

                                                              @Bern:

                                                              I was having the problem with states during the week.

                                                              I've updated to:

                                                              1.2.3-RC2
                                                              built on Sun Jun 14 18:15:10 EDT 2009

                                                              and it looks like it's fixed now.

                                                              With the latest snap my test box also appears to be normal. I haven't reflashed my embedded box yet, the new snap just appeared for that a couple minutes ago.

                                                              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                                              Need help fast? Netgate Global Support!

                                                              Do not Chat/PM for help!

                                                              1 Reply Last reply Reply Quote 0
                                                              • H
                                                                Hugovsky last edited by

                                                                Just updated. I'll post the results asap.

                                                                1 Reply Last reply Reply Quote 0
                                                                • H
                                                                  Hugovsky last edited by

                                                                  The problem seems gone. I have now 98 states. Thx for fixing it. ;)

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • jimp
                                                                    jimp Rebel Alliance Developer Netgate last edited by

                                                                    My states are also back to normal on my embedded box.

                                                                    Thank ermal for fixing it, he's the one who put the patch in that corrected it :)

                                                                    Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                                                    Need help fast? Netgate Global Support!

                                                                    Do not Chat/PM for help!

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • First post
                                                                      Last post