0

As per the article on nixCraft

This iptables rule(s):

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

-A INPUT -j sanity
-A sanity -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m comment --comment "LOG non-SYN packets" -j LOG --log-prefix "NOSYN Dropped" --log-level 1
-A sanity -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m comment --comment "Force SYN packets" -j DROP

(sanity is the first chain jump in INPUT) I've been seeing unexpected drops in my logs:

/var/log/kern.log:Feb 19 13:11:30 [masked] kernel: NOSYN DroppedIN=eth0 OUT= MAC=f2:3c:91:96:b7:8a:84:78:ac:5a:19:41:08:00 SRC=81.41.144.32 DST=[masked] LEN=41 TOS=0x00 PREC=0x20 TTL=117 ID=4381 DF PROTO=TCP SPT=50161 DPT=80 WINDOW=259 RES=0x00 ACK URGP=0 <-- dozens of these lines

But in my nginx log files, this user seems to have no issues:

81.41.144.32 - - [19/Feb/2019:13:08:09 -0700] "GET / HTTP/1.1" 200 4062 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36"
81.41.144.32 - - [19/Feb/2019:14:07:17 -0700] "GET / HTTP/1.1" 200 4062 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36"
81.41.144.32 - - [19/Feb/2019:14:08:03 -0700] "GET /download.html HTTP/1.1" 200 2074 "[masked]" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36"
81.41.144.32 - - [19/Feb/2019:14:08:20 -0700] "GET /downloads/[masked].exe HTTP/1.1" 200 4842504 "http://[masked]/download.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36"

Each request is successful with the correct size transferred.

I'm also seeing packets dropped that initiate from my own IP to my server on port 993 but I've experienced no issues with email retrieval.

Why am I seeing all of these dropped packets? Is this to be expected from legitimate traffic?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy