IPTables Registrando uma inundação de mensagens “TCP INCOMPLETE”

Question

Atualmente estou tentando investigar o que parece ser um problema relacionado à carga com um servidor da web e descobri uma inundação de logs do IPTables que não reconheço. Todos eles se parecem com isso:

Feb 26 12:03:52 dop002 warning [2559556.039033] IN=eth1 OUT= MAC=snip SRC=88.115.48.62 DST=snip LEN=56 TOS=0x00 PREC=0x00 TTL=54 ID=14166 PROTO=ICMP TYPE=5 CODE=1 GATEWAY=88.115.48.1 [SRC=snip DST=88.115.60.143 LEN=40 TOS=0x00 PREC=0x00 TTL=57 ID=42868 DF PROTO=TCP INCOMPLETE [8 bytes] ]

Alguém pode me dizer o que esta linha de log significa? Há uma tonelada deles em / var / log / messages.

Obrigado.

    

Answer 1

Esta é uma mensagem ICMP Tipo 5.

RFC 792

Description

 The gateway sends a redirect message to a host in the following
 situation.  A gateway, G1, receives an internet datagram from a
 host on a network to which the gateway is attached.  The gateway,
 G1, checks its routing table and obtains the address of the next
 gateway, G2, on the route to the datagram's internet destination
 network, X.  If G2 and the host identified by the internet source
 address of the datagram are on the same network, a redirect
 message is sent to the host.  The redirect message advises the
 host to send its traffic for network X directly to gateway G2 as
 this is a shorter path to the destination.  The gateway forwards
 the original datagram's data to its internet destination.

 For datagrams with the IP source route options and the gateway
 address in the destination address field, a redirect message is
 not sent even if there is a better route to the ultimate
 destination than the next address in the source route.

 Codes 0, 1, 2, and 3 may be received from a gateway.