<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<pre class="moz-signature" cols="72">
</pre>
<div class="moz-cite-prefix">On 24-Feb-25 17:54, Peter 'PMc' Much
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:Z7z4s7iU0NWj7ZOq@disp.intra.daemon.contact">
<pre class="moz-quote-pre" wrap="">tcpdump was friendly enough to tell me I should use -vv option,
only I didn't read that at first.
Then it clearly shows that these packets have invalid checksums. :(
And that is apparently reason enough to just drop them without
notice.
Now how they aquire broken checksums, and why they start to
do so two days ago (because I find some successful XFR in the log,
until Feb-22), that is another story.</pre>
</blockquote>
<p>A couple of hints:<br>
</p>
<p>The bad checksums may be a false lead. If you have a network
interface that off-loads checksum computation, the checksum (valid
or invalid) may not appear in the user/trace buffer. (Depends on
the interface & driver.) <br>
</p>
<p>If your NAT is changing IP addresses, it may not recompute the
checksum (for the same reason - you can't count on it being valid
in the buffer).<br>
</p>
<p>You can mark packets with IPtables to make tracking/logging
easier.<br>
</p>
<p><br>
</p>
<pre class="moz-signature" cols="72">Timothe Litt
ACM Distinguished Engineer
--------------------------
This communication may not represent the ACM or my employer's views,
if any, on the matters discussed.
</pre>
<p></p>
<p><span style="white-space: pre-wrap">
</span></p>
<div id="grammalecte_menu_main_button_shadow_host"
style="width: 0px; height: 0px;"></div>
</body>
</html>