There is a network issue I have not encountered before. It seems that UDP traffic is entering the operating system since using systat -ifstat -match re1 0.5 shows the in bandwidth spiking for a moment whenever I send a batch of test traffic over from a remote host.

However, I can see that the counters given by something like ipfw show | grep -E '10300|65535' (where 10300 and 65535 are my only deny rules), are not incrementing. Additionally, I have a rule:

00001     0        0 allow udp from any to x.x.x.x dst-port 4501

which as you can see has not been touched at all, even though the traffic I'm sending is on that port. tcpdump also shows nothing on the external interface or on ipfw0.

One important thing to note is that this machine is behind a new gateway. It doesn't seem to have any problems, and internet access seems to work fine; and also TCP ports listening on this machine are reachable as normal. It's just UDP. The only thing I can think of is the UDP datagrams are somehow getting mangled at some point and consequently are not being presented to the user space by the OS as they are malformed. But I'm hoping it's just something silly that I've overlooked.

I wonder if there is a dtrace script I can use here?

# uname -r
11.1-RELEASE-p2

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.