I've been seeing this thing a lot lately. Any idea what does this one mean?
Usually it means that a packet tried to flow back and the original state had been removed.
You'll see that a lot with squid or some other similar transparent proxy active.
Thanks for the assistance. I'm just wondering why this IP 192.168.0.182 looks like its trying to connect to multiple IP. In my network i see 4 of these IP having this strange connections.
cmb last edited by
That particular screenshot looks to be bittorrent traffic blocked out of state, which would explain large numbers of connections and relative frequency of out of state traffic.
I also have these in my pfTop and its scrolling very fast.
![firewall log.jpg](/public/imported_attachments/1/firewall log.jpg)
![firewall log.jpg_thumb](/public/imported_attachments/1/firewall log.jpg_thumb)
Nucleus last edited by
Can someone please explain to me why the packets would make it to the LAN adapter if the state was removed?
Shouldn't it be blocked at the WAN adapter and logged as such? Or is it showing the LAN adapter because that was where the state originated?
Most likely, the NAT state may have still been there (UPnP perhaps?) but the actual firewall state was gone.