Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a question about NFS and PF (freebsd). I know that NFS uses both TCP and UDP to connect to the client along with a bunch of daemons that use random port numbers. Both the NFS server and client are Ubuntu 10.04. Instead of using port numbers for the filtering, I simply used the IP addresses of the client and server to allow the connection. The pf.conf rules pertaining to NFS are:

pass in log quick  from external to NFS
pass out log quick from NFS to external

As you can see, the external name is the client and NFS is the server. Both are resolved to their IP addresses. The problem is that some of the packets are being stopped by PF with the following error:

11:38:52.440123 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
NFS-lan0.sunrpc > External-lan1.38390:  tcp 40 [bad hdr length 0 - too short, < 20]
share|improve this question

closed as not a real question by Rory Alsop Jan 17 '12 at 9:40

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Is it blocking the packet or just logging that message? That log entry looks more like tcpdump rather than PF and most likely has a relation to the snaplen configuration used. –  securityishard Oct 10 '11 at 19:51
    
i used the command tcpdump -i pflog0, I assume that tcpdump is reading from the pflog0 in real time –  tpar44 Oct 10 '11 at 19:57
    
There isn't actually a question here. If you can provide a question we can re-open. –  Rory Alsop Jan 17 '12 at 9:41

Browse other questions tagged or ask your own question.