Project

General

Profile

Actions

Bug #2121

closed

Todo #2109: pfSense on FreeBSD 10.x

pfctl -ss output has changed on FreeBSD 10

Added by Jim Pingle over 10 years ago. Updated over 7 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Web Interface
Target version:
Start date:
01/20/2012
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2
Affected Architecture:

Description

The state parsing code in diag_dump_states.php and elsewhere needs updated since on FreeBSD 9.x the format of the state output has changed.

For example, previously a NAT state looked like so:

all tcp internalip:64123 -> externalip:39329 -> destinationip:80    ESTABLISHED:ESTABLISHED

And now it looks like:

all tcp externalip:37706 (internalip:1051) -> destinaionip:80       ESTABLISHED:ESTABLISHED


Files

diag_dump_states.png (9.59 KB) diag_dump_states.png Thiago Basilio, 09/22/2014 09:13 AM
Actions #1

Updated by Seth Mos over 10 years ago

maybe fixup on the state print patches so that the -> is added back?

Actions #2

Updated by Jim Pingle over 10 years ago

I think I prefer the new output, it's a clearer separation for which is the internal IP rather than guess by counting ->'s

Probably need some more output examples though (say, from 1:1 NAT and port forwards) to really say how hard it might be to adjust.

Actions #3

Updated by Erik Fonnesbeck over 10 years ago

Looks like the format for the changed part is like this:

NAT on destination (port forward)
destination_after_nat (destination_before_nat) <- source

NAT on source (outbound NAT)
source_after_nat (source_before_nat) -> destination

Actions #4

Updated by Jim Pingle over 10 years ago

  • Parent task set to #2109
Actions #5

Updated by Jim Pingle about 10 years ago

  • Target version changed from 2.1 to 2.2
Actions #6

Updated by Chris Buechler about 10 years ago

  • Affected Version changed from 2.1 to 2.2
Actions #7

Updated by Renato Botelho over 8 years ago

  • Subject changed from pfctl -ss output has changed on FreeBSD 9 to pfctl -ss output has changed on FreeBSD 10
Actions #8

Updated by Jim Pingle over 8 years ago

The format is slightly different on 10.x than 9.x examples above.
In this sample output, 192.0.2.x is WAN on em0, 192.168.94.x is LAN on em1

em0 icmp 192.0.2.89:32114 -> 192.0.2.1:32114       0:0
em0 icmp 192.0.2.89:44428 (192.168.94.1:26879) -> 74.125.225.114:44428       0:0
lo0 udp 127.0.0.1:43924 -> 127.0.0.1:53       MULTIPLE:SINGLE
em0 tcp 192.168.94.99:999 (192.0.2.89:999) <- 192.0.2.31:59269       CLOSED:SYN_SENT
em1 tcp 192.0.2.31:59269 -> 192.168.94.99:999       SYN_SENT:CLOSED

The first column for the interface should probably be parsed and printed on the page now that it is meaningful.

Actions #9

Updated by Jim Pingle almost 8 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100
Actions #10

Updated by Jim Thompson over 7 years ago

  • Assignee set to Jim Pingle
Actions #11

Updated by Jim Pingle over 7 years ago

  • Status changed from Feedback to New

Moving this back to New. The states table display is OK now but diag_states_summary.php breaks with the new formatting.

Actions #12

Updated by Jim Pingle over 7 years ago

  • Status changed from New to Feedback
Actions #13

Updated by Thiago Basilio over 7 years ago

Latest snapshot seems OK.

(pfctl -ss output)

$ pfctl -ss
re1 tcp 192.168.228.18:8530 <- 192.168.1.100:1049       ESTABLISHED:ESTABLISHED
re0 icmp 192.168.228.107:6213 -> 192.168.228.1:6213       0:0
lo0 ipv6-icmp ff02::1[16448] <- fe80::1:1[16448]       NO_TRAFFIC:NO_TRAFFIC
re1 ipv6-icmp fe80::1:1[16448] -> ff02::1[16448]       NO_TRAFFIC:NO_TRAFFIC
re1 tcp 192.168.1.1:443 <- 192.168.1.100:1195       ESTABLISHED:ESTABLISHED
re0 tcp 192.168.228.107:46232 -> 208.123.73.83:443       FIN_WAIT_2:FIN_WAIT_2

For diag_dump_states.php output, there is a image attached.

..
pfSense 2.2-BETA amd64
Firefox ESR 24.8.0 win32
..

Actions #14

Updated by Jim Pingle over 7 years ago

  • Status changed from Feedback to Resolved
Actions

Also available in: Atom PDF