From: Mohammad Khan <mkhan@lextranet.com>
To: Jason Opperisano <opie@817west.com>
Cc: netfilter@lists.netfilter.org
Subject: Re: What about these packets?
Date: Fri, 28 Jan 2005 21:50:49 -0500 [thread overview]
Message-ID: <1106967050.21043.7.camel@croaker> (raw)
In-Reply-To: <1106966592.4592.5.camel@hubcap.ljm.dom>
On Fri, 2005-01-28 at 21:43 -0500, Jason Opperisano wrote:
> On Fri, 2005-01-28 at 21:29, Mohammad Khan wrote:
> > two rules in my INPUT chains are:
> > -A INPUT -s 63.110.21.51 -m state --state NEW -j LOG --log-prefix
> > "PLAYNC_NEW " --log-level debug
> > -A INPUT -s 63.110.21.51 -m state --state NEW -j DROP
> >
> > My router is keeping the following logs
> >
> > Jan 28 18:32:46 stingray kernel: PLAYNC_NEW IN=eth0 OUT=
> > MAC=00:c0:26:63:47:f5:00:90:1a:40:a2:9f:08:00 SRC=63.110.21.51
> > DST=x.x.x.x LEN=32 TOS=0x00 PREC=0x20 TTL=1 ID=775 PROTO=UDP SPT=14339
> > DPT=33438 LEN=12
> > Jan 28 18:32:46 stingray kernel: PLAYNC_NEW IN=eth0 OUT=
> > MAC=00:c0:26:63:47:f5:00:90:1a:40:a2:9f:08:00 SRC=63.110.21.51
> > DST=x.x.x.x LEN=32 TOS=0x00 PREC=0x20 TTL=1 ID=1031 PROTO=UDP SPT=14339
> > DPT=33440 LEN=12
> > Jan 28 18:32:51 stingray kernel: PLAYNC_NEW IN=eth0 OUT=
> > MAC=00:c0:26:63:47:f5:00:90:1a:40:a2:9f:08:00 SRC=63.110.21.51
> > DST=x.x.x.x LEN=32 TOS=0x00 PREC=0x20 TTL=2 ID=776 PROTO=UDP SPT=14339
> > DPT=33438 LEN=12
> > Jan 28 18:32:51 stingray kernel: PLAYNC_NEW IN=eth0 OUT=
> > MAC=00:c0:26:63:47:f5:00:90:1a:40:a2:9f:08:00 SRC=63.110.21.51
> > DST=x.x.x.x LEN=32 TOS=0x00 PREC=0x20 TTL=2 ID=1032 PROTO=UDP SPT=14339
> > DPT=33440 LEN=12
> > Jan 28 18:32:56 stingray kernel: PLAYNC_NEW IN=eth0 OUT=
> > MAC=00:c0:26:63:47:f5:00:90:1a:40:a2:9f:08:00 SRC=63.110.21.51
> > DST=x.x.x.x LEN=32 TOS=0x00 PREC=0x20 TTL=2 ID=776 PROTO=UDP SPT=14339
> > DPT=33438 LEN=12
> > Jan 28 18:32:56 stingray kernel: PLAYNC_NEW IN=eth0 OUT=
> > MAC=00:c0:26:63:47:f5:00:90:1a:40:a2:9f:08:00 SRC=63.110.21.51
> > DST=x.x.x.x LEN=32 TOS=0x00 PREC=0x20 TTL=2 ID=1032 PROTO=UDP SPT=14339
> > DPT=33440 LEN=12
> > Jan 28 18:33:01 stingray kernel: PLAYNC_NEW IN=eth0 OUT=
> > MAC=00:c0:26:63:47:f5:00:90:1a:40:a2:9f:08:00 SRC=63.110.21.51
> > DST=x.x.x.x LEN=32 TOS=0x00 PREC=0x20 TTL=3 ID=777 PROTO=UDP SPT=14339
> > DPT=33438 LEN=12
> >
> >
> > I have replace my original ip with x.x.x.x
> > What can I say about these packets?
> > Please let me learn more details about this packet.
>
> judging from the destination UDP ports and the TTL--i would say that
> they are traceroute packets.
>
> -j
my log file is full of this shit.
Are they doing traceroute for all the day long??
>
> --
> "What's the point of going out, we're just going to end up back
> here anyway?"
> --The Simpsons
>
>
next prev parent reply other threads:[~2005-01-29 2:50 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-01-29 2:29 What about these packets? Mohammad Khan
2005-01-29 2:43 ` Jason Opperisano
2005-01-29 2:50 ` Mohammad Khan [this message]
2005-01-29 7:55 ` Frank Gruellich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1106967050.21043.7.camel@croaker \
--to=mkhan@lextranet.com \
--cc=netfilter@lists.netfilter.org \
--cc=opie@817west.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.