LOG entry format: MAC field

LOG entry format: MAC field

[Konstantin Dorichev]

Hi, folks:

Could anyone please comment on MAC field in iptables log entry? Why does it 
have 14 bytes instead of 6 as it should be for Ethernet card MAC address? Or 
this field means something else?

Also, since my firewall is being scanned, there are many entries in log file 
with different source IPs, yet the same MACs. Is there a way to trace the 
scanning host back?

Thanks for whatever you may suggest.

Below are a few log entries for your consideration:

Feb 11 16:34:10 gateway kernel: IPT INPUT packet died: IN=eth0 OUT= 
MAC=00:50:04:a2:08:91:00:01:42:1b:57:20:08:00 SRC=80.117.120.207 
DST=212.85.17.62 LEN=52 TOS=0x00 PREC=0x00 TTL=48 ID=21343 DF PROTO=TCP 
SPT=4504 DPT=57 WINDOW=60352 RES=0x00 SYN URGP=0

Feb 11 17:56:27 gateway kernel: IPT INPUT packet died: IN=eth0 OUT= 
MAC=00:50:04:a2:08:91:00:01:42:1b:57:20:08:00 SRC=61.139.69.22 
DST=212.85.17.62 LEN=404 TOS=0x00 PREC=0x00 TTL=106 ID=51580 PROTO=UDP 
SPT=1305 DPT=1434 LEN=384

Feb 11 19:35:40 gateway kernel: IPT INPUT packet died: IN=eth0 OUT= 
MAC=00:50:04:a2:08:91:00:01:42:1b:57:20:08:00 SRC=204.31.160.26 
DST=212.85.17.62 LEN=404 TOS=0x00 PREC=0x00 TTL=107 ID=14329 PROTO=UDP 
SPT=1367 DPT=1434 LEN=384

P.S. Many thanks to Ockar Andreasson for his Iptables Tutorial.
-- 
Best regards,

Konstantin Dorichev
EPIC Advisors (Russia) Ltd.
System Administrator

Re: LOG entry format: MAC field

[Cedric Blancher]

Le mer 19/02/2003 à 10:36, Konstantin Dorichev a écrit :
> Could anyone please comment on MAC field in iptables log entry? Why does it 
> have 14 bytes instead of 6 as it should be for Ethernet card MAC address? Or 
> this field means something else?

In fact MAC does not stand for MAC address, but for MAC header. This 14
bytes field is the ethernet layer header hexa dump which is :

	6 bytes : DST MAC
	6 bytes : SRC MAC
	2 bytes : Ethertype (i.e. payload type)

> MAC=00:50:04:a2:08:91:00:01:42:1b:57:20:08:00 SRC=80.117.120.207 

DST MAC : 00:50:04:a2:08:91 (i.e. your box)
SRC MAC : 00:01:42:1b:57:20 (i.e. your access router I guess)
ETHTYPE : 08:00 (i.e. IP)

I do think this URL will be useful for you :)))

	http://logi.cc/linux/netfilter-log-format.php3

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE