Hi,
We have a Check Point FP 3 installed on a Red Hat Linux 2.4.9
which has two interfaces eth0 and eth1. The simplified
network topology looks like:
C ------ (eth1) FW (eth0) ----- S
where C, FW, and S means a client, the FW-1 FP3, and the POP3
server, respectively.
Sometimes when C tries to connect the TCP port 110 on S, after
the 3-way handshaking process succeeds and a TCP connection is
established, C does not get the POP banner which is usually
sent immediately from S.
Running tcpdump on eth0 and eth1 of the FW and also on S,
we confirm that the lost packet containing the POP3 banner
is actually sent from S and received by FW on eth0. However,
this packet does not appear on eth1 and is lost somehow
somewhere.
To further investigate where the packet is discarded, we use
fw monitor with options -s and '-p all' to look into the in
chain and out chain and get the following result.
monitor: loading
in chain (7):
0: -7f800000 (f8a28af8) IP Options Strip (ipopt_strip)
1: - 1f00000 (f8a2954c) Stateless verifications (asm)
2: 0 (f89fe9e4) fw VM inbound (fw)
3: 10 (f8a0de10) fw accounting inbound (acct)
4: 10000000 (f8a36b38) SecureXL inbound (secxl)
5: 7f600000 (f8a2579c) fw SCV inbound (scv)
6: 7f800000 (f8a28d54) IP Options Restore (ipopt_res)
out chain (6):
0: -7f800000 (f8a28af8) IP Options Strip (ipopt_strip)
1: - 1f00000 (f8a2954c) Stateless verifications (asm)
2: 0 (f89fe9e4) fw VM outbound (fw)
3: 10000000 (f8a36b38) SecureXL outbound (secxl)
4: 7f000000 (f8a0de10) fw accounting outbound (acct)
5: 7f800000 (f8a28d54) IP Options Restore (ipopt_res)
monitor: monitoring (control-C to stop)
[9fe60700 - 405fe69f 00000007 fe01010a 000007b6]:eth0:i0 (IP
Options Strip)[74]: IP_of_S -> IP_of_C 8 (TCP) len=74
id=51214
TCP: 110 -> 61151 ...PA. seq=7ed8fa09 ack=600db360
[9fe60700 - 405fe69f 00000007 fe01010a 000007b6]:eth0:i1
(Stateless verifications)[74]: IP_of_S -> IP_of_C (TCP)
len=74 id=51214
TCP: 110 -> 61151 ...PA. seq=7ed8fa09 ack=600db360
[9fe60700 - 405fe69f 00000007 fe01010a 000007b6]:eth0:i2
(fw VM inbound )[74]: IP_of_S -> IP_of_C (TCP) len=74
id=51214
TCP: 110 -> 61151 ...PA. seq=7ed8fa09 ack=600db360
With tcpdump running at the same time as fw monitor, we
know that the packet with IP ID 51214 contains the POP
banner from S. As shown in the above, this packet enters
FW-1, gets processed by ipopt_strip and asm, and disappears
after the fw module. No packet with the same IP ID is
shown in the post-inbound chain and the entire outbound
chain.
Most of the time, C can set up a POP3 session with S and
gets mail without any problem. When the above situation
occurs, the fwx_cache table is always filled with 10000
entries, as shown in the following:
# fw tab -s -t fwx_cache
HOST NAME ID #VALS #PEAK #SLINKS
localhost fwx_cache 8116 10000 10000 0
Does anyone knows why the above situations (similar
packets gets discarded sometimes by the FW-1 and gets
passed sometimes) occurs? Could it be the result of
a full fwx_cache table?
In addition, how can I increase the size of the fwx_cache
table? Yes, I read the post on
http://lists.virus.org/fw1-0310/msg00415.html.
Unfortunately, for some unknown reason, our account on
Check Point support web site does not allow us to see
the article with ID sk21834.
Finally, we would like to figure out why the fwx_cache
table fills up so quickly but do not know the meaning
of fields in the table. Neither does the ATRG mention
the fwx_cache table. Could anybody give some help?
Any information is greatly appreciated.
Thank you very much.
--
Fuh-Jyi Chang
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
