Watchguard Firebox X1000, Reference Manual

Page: 82 / 264

CHAPTER 5: Common Log Messages
70 WatchGuard Firebox System
band management. The Firebox always attempts to communicate
with a PCMCIA modem and will report this error if none is found.
controld: ERROR: Receiving another configuration file from
firebox 10.1.16.2.
Indicates that the current configuration file is corrupted or
incomplete. The Event Processor will close the connection.
deny in eth0 tcp www.xxx.yyy.zzz www.xxx.yyy.zzz 25 1200 80
psh ack
A psh ack is an acknowledgement of a push. Push is a type of TCP
message that tells the receiving process to push the data directly
to the receiving application instead of caching it locally for
transmit. This message appears either because the source is a
blocked site or port, a spoofed source address, or an Any service
with logging enabled.
deny in eth0 tcp www.xxx.yyy.zzz www.xxx.yyy.zzz 2981 80 rst
(blocked site)
TCP connections are controlled through a series of packets
exchanged by the two computers involved in the connection. Old,
stale TCP connections are reset with an RST packet. RST packets
have a sequence number that must be valid according to certain
TCP rules. For example, Denial of Service (DoS) attacks can be
launched against some hosts by spoofing TCP RST packets
against connections that conflict with current connections. Bare
TCP RST packets can also be sent as a type of OS fingerprinting to
determine the target's operating system.
dns-proxy[xx] dns_setup_connect_udp: Unable to create UDP
socket for port: Invalid argument
The DNS proxy has only 256 file descriptors available for its use,
which limits the number of DNS connections in a NAT
environment. Every UDP request that uses dynamic NAT uses a
file descriptor for the duration of the UDP timeout. Every TCP
session that uses dynamic, static, or 1-to-1 NAT uses a file
descriptor for the duration of the session.
The file descriptor limit is rarely a problem, but an occasional site
may notice slow name resolution and many instances of the above
log message
You can work around this problem in two ways (the first method
is the most secure):