Logging default drop

Logging default drop

[Stuart Lamble]

Hi All

Can you LOG a default policy of DROP?


Thanks
Stu


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

Re: Logging default drop

[Antony Stone]

On Wednesday 07 April 2004 9:29 pm, Stuart Lamble wrote:

> Hi All
>
> Can you LOG a default policy of DROP?

Yes.   Add the LOG rule as the last one in the chain.

Regards,

Antony.

-- 
Perfection in design is achieved not when there is nothing left to add, but 
rather when there is nothing left to take away.

 - Antoine de Saint-Exupery

                                                     Please reply to the list;
                                                           please don't CC me.

RE: Logging default drop

[Stuart Lamble]

Hi All

I enabled the rule at the end of my INPUT tables,
iptables -A INPUT -j LOG --log-prefix "IN-DEfault-drop "

I then tail my messages file and get a LOT of the following....

Apr  8 20:25:04 firewall kernel: IN-DEfault-drop IN=ppp0 OUT= MAC=
SRC=220.255.12.210 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x40 TTL=40 ID=20518
PROTO=ICMP TYPE=8 CODE=0 ID=256 SEQ=6625

The SRC address is ofter different.
What does this mean?

Thanks
Stu

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
Sent: Wednesday, April 07, 2004 10:35 PM
To: netfilter@lists.netfilter.org
Subject: Re: Logging default drop


On Wednesday 07 April 2004 9:29 pm, Stuart Lamble wrote:

> Hi All
>
> Can you LOG a default policy of DROP?

Yes.   Add the LOG rule as the last one in the chain.

Regards,

Antony.

-- 
Perfection in design is achieved not when there is nothing left to add,
but 
rather when there is nothing left to take away.

 - Antoine de Saint-Exupery

                                                     Please reply to the
list;
                                                           please don't
CC me.



---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

Re: Logging default drop

[Frank Gruellich]

* Stuart Lamble <stu@gateway10.homeip.net>  8. Apr 04:
> Hi All

Hello,

> iptables -A INPUT -j LOG --log-prefix "IN-DEfault-drop "
> 
> I then tail my messages file and get a LOT of the following....
> 
> [logged packet]
> 
> The SRC address is ofter different.

This is normal.

> What does this mean?

Congratulation, you catched a ping.  For complete description read
<URL:http://logi.cc/linux/netfilter-log-format.php3>.  And please, don't
toppost.

HTH,
 regards, Frank.
-- 
Sigmentation fault

RE: Logging default drop

[Stuart Lamble]

Ok, so what does "toppost" mean?



-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Frank
Gruellich
Sent: Thursday, April 08, 2004 7:03 PM
To: netfilter@lists.netfilter.org
Subject: Re: Logging default drop


* Stuart Lamble <stu@gateway10.homeip.net>  8. Apr 04:
> Hi All

Hello,

> iptables -A INPUT -j LOG --log-prefix "IN-DEfault-drop "
> 
> I then tail my messages file and get a LOT of the following....
> 
> [logged packet]
> 
> The SRC address is ofter different.

This is normal.

> What does this mean?

Congratulation, you catched a ping.  For complete description read
<URL:http://logi.cc/linux/netfilter-log-format.php3>.  And please, don't
toppost.

HTH,
 regards, Frank.
-- 
Sigmentation fault


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

Re: Logging default drop

[Antony Stone]

On Thursday 08 April 2004 6:24 pm, Stuart Lamble wrote:

> Ok, so what does "toppost" mean?

Regards,

Antony.

-- 
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing on usenet and in e-mail?

                                                     Please reply to the list;
                                                           please don't CC me.

RE: Logging default drop

[Stuart Lamble]

I was not aware that I was doing that. Is it to do with this damn
outlook Cr@P that I am using?

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
Sent: Thursday, April 08, 2004 7:31 PM
To: netfilter@lists.netfilter.org
Subject: Re: Logging default drop


On Thursday 08 April 2004 6:24 pm, Stuart Lamble wrote:

> Ok, so what does "toppost" mean?

Regards,

Antony.

-- 
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing on usenet and in e-mail?

                                                     Please reply to the
list;
                                                           please don't
CC me.



---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

Re: Logging default drop

[Antony Stone]

On Thursday 08 April 2004 6:40 pm, Stuart Lamble wrote:

> I was not aware that I was doing that. Is it to do with this damn
> outlook Cr@P that I am using?

Yes - you've just done it again :)

The idea is that you should write your response underneath the bit which I 
wrote, which you're responding to, so that it makes sense as a conversation.

If you post your comment at the top of an email, people have to read my bit 
underneath first, to find out what it's about, then go back up to the top to 
find out what you said afterwards....

Regards,

Antony.

> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
> Sent: Thursday, April 08, 2004 7:31 PM
> To: netfilter@lists.netfilter.org
> Subject: Re: Logging default drop
>
> On Thursday 08 April 2004 6:24 pm, Stuart Lamble wrote:
> > Ok, so what does "toppost" mean?
>
> Regards,
>
> Antony.

-- 
These clients are often infected by viruses or other malware and need to be 
fixed.  If not, the user at that client needs to be fixed...

 - Henrik Nordstrom, on Squid users' mailing list

                                                     Please reply to the list;
                                                           please don't CC me.

RE: Logging default drop

[Stuart Lamble]

>-----Original Message-----
>From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
>Sent: Thursday, April 08, 2004 7:50 PM
>To: netfilter@lists.netfilter.org
>Subject: Re: Logging default drop


>On Thursday 08 April 2004 6:40 pm, Stuart Lamble wrote:

> I was not aware that I was doing that. Is it to do with this damn 
> outlook Cr@P that I am using?

>Yes - you've just done it again :)

>The idea is that you should write your response underneath the bit
which I 
>wrote, which you're responding to, so that it makes sense as a
conversation.

>If you post your comment at the top of an email, people have to read my
bit 
>underneath first, to find out what it's about, then go back up to the
top to 
>find out what you said afterwards....

OK, makes good sense, At least now that someone has explained it to me I
understand it.


>Regards,

>Antony.

> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
> Sent: Thursday, April 08, 2004 7:31 PM
> To: netfilter@lists.netfilter.org
> Subject: Re: Logging default drop
>
> On Thursday 08 April 2004 6:24 pm, Stuart Lamble wrote:
> > Ok, so what does "toppost" mean?
>
> Regards,
>
> Antony.

-- 
These clients are often infected by viruses or other malware and need to
be 
fixed.  If not, the user at that client needs to be fixed...

 - Henrik Nordstrom, on Squid users' mailing list

                                                     Please reply to the
list;
                                                           please don't
CC me.



---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

RE: Logging default drop

[Rob Sterenborg]

On Thu, 2004-04-08 at 19:40, Stuart Lamble wrote:
> I was not aware that I was doing that. Is it to do with this damn
> outlook Cr@P that I am using?

Ermmm.. 

Perhaps you could just cut out irrelevant text and move your cursor to
the bottom of the email and start typing, or, if you want to react to a
specific piece, insert a few lines and write your comment in the space
you just created. That way we all know what you are reacting to.
I know I can do that with Outlook.


Gr,
Rob

RE: Logging default drop

[Stuart Lamble]

>On Thu, 2004-04-08 at 19:40, Stuart Lamble wrote:
>> I was not aware that I was doing that. Is it to do with this damn 
>> outlook Cr@P that I am using?

>Ermmm.. 

>Perhaps you could just cut out irrelevant text and move your cursor to
the bottom of the email and start typing, or, if
>you want to react to a specific piece, insert a few lines and write
your comment in the space you just created. That way
>we all know what you are reacting to. I know I can do that with
Outlook.

OK, thanks for explaining it so nicely. I must admit that even though I
have read many, many of these posts, I never really noticed that.
The art of proper communication is sweet.

>Gr,
>Rob




---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004