05-19-2021 11:27 PM
I am seeing a strange behavior with DNS traffic. I tried to resolve some FQDns which work fine (those are public fqdns). But when I do the packet capture, I can see the same packets in transmit and drop stage. By comparing the tcp port and dns transaction id, i can see those packets sent only once by end machine and the same in both transmit and drop stage. Even i can see the DNS server is responding with the IP address and from end machine, the fqdn is resolved. I am trying to figure out why the packet in drop stage as it causes confition. Also this is not happening always, this is very random.
I even tried floe capture, in flow capture I cannot see the drop, in fact there is a gap in flow capture at the time of transmitting and drop time(which means i cannot see this transmit and drop in the flow capture).
05-20-2021 12:26 AM
packet-diag logging is not stateful (it does account for NAT), so for a flow basic you need to add filters that account for both flows, and also add a filter for 'stray' packets in case the packet is discarded because the firewall can't match it to a session
I usually filter like this:
2. pubdest -pubsrc-srcport
did you check the global counters for drops ? (retry global counters with the above filters as well, in case a packet arrives 'out of window')
05-20-2021 12:38 AM - edited 05-20-2021 12:47 AM
Hi @reaper ,
Packet diag is set accounting for the NAT as well. As mentioned, I can see the dropped NATed packet.
Strange thing is i can see the same packet in transmit stage to ISP ( compared dns id and source port and destination mac to confirm it is going to ISP). The public DNS is responding to the query successfully and the client is resolving the fqdn.. Just not sure why the packet in the drop stage when it actually indicates the packet went through.
I was able to see some counters like 'DNS packet drops while waiting' not sure if it is related ( as I have capture filter for fw_public ip to dns, it will include other clients requests as well)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!