[lvs-users] Iptables find invalid packets

To: lvs-users@xxxxxxxxxxxxxxxxxxxxxx
Subject: [lvs-users] Iptables find invalid packets
From: Dimitri GOURDON <dgourdon@xxxxxxxxx>
Date: Mon, 21 Jul 2008 12:51:23 +0200
Hi all,

I've setup LVS on a box using Keepalived (and Iptables) to load balance 
traffic between 2 web servers. I have a problem :

A lot of TCP packets with FIN or RST flags (all I think) are dropped by 
Iptables as state INVALID. The consequence is that I have a lot of 
connection in FIN_WAIT state (shown by netstat) on the 2 web servers...

I have reproduced this on my lab...

I have sniff packets with tcpdump to see flags, ACK number,... I've 
found nothing bad.

I have tried to accept these packets with Iptables and then, all my 
connections are terminated in a normal way (only 1-2 connection(s) stay 
in FIN_WAIT on web servers).

I know I can play with TCP timeout to reduce this behavior, but I'll 
prefer correct the problem. I don't understand why these packets are 
invalid if when I accept them, the connections end normaly...

Google is NOT my friend on this issue.

Is someone can help me ???

Dimitri Gourdon
Linux Web Administrator
Itool systems

PS : Sorry for my poor english !

<Prev in Thread] Current Thread [Next in Thread>