From: Antony Stone <Antony@Soft-Solutions.co.uk>
To: netfilter@lists.netfilter.org
Subject: Re: Log question
Date: Mon, 7 Jun 2004 16:06:37 +0100 [thread overview]
Message-ID: <200406071606.37187.Antony@Soft-Solutions.co.uk> (raw)
In-Reply-To: <40C48126.9030003@whitehallcanada.com>
On Monday 07 June 2004 3:52 pm, Michael Sams wrote:
> Hi there... I am sorry if this questions has already been asked. I am
> try to understand some iptables logs. The one I have attached I don't
> really understand. Could someone point me in the right direction?
>
> Any help is greatly appreciated!
>
> 1.2.3.4 = My server
>
> Jun 7 02:23:48
Date & time - pretty obvious :)
> myserver
Your server's hostname.
> kernel:
Kernel log message
> INVALID STATE:
The string you specified for "log-prefix"
> IN=lo
Packet came in on loopback interface
> OUT=
Packet is not going to go out on any interface
> MAC=00:00:00:00:00:00
Destination MAC address is blank (loopback doesn't use it).
> :00:00:00:00:00:00:
Source MAC address is blank (loopback doesn't use it)
>08:00
Protocol is IP over ethernet
> SRC=1.2.3.4
Source IP address
> DST=1.2.3.4
Destination IP address
> LEN=68
Packet length including headers.
> TOS=0x00
Type Of Service flags not set (= 0000 0000)
> PREC=0xC0
Precedence bits = 1100 0000
> TTL=64
Time to live = 64: another 64 hops to go before the packet expires
> ID=13447
ICMP ID number = 13447
> PROTO=ICMP
This is an ICMP packet
> TYPE=3
ICMP type = 3 (Destination Unreachable)
> CODE=1
ICMP code = 1 (Host Unreachable)
> [SRC=1.2.3.4 DST=219.141.107.<snip> LEN=40 TOS=0x00 PREC=0x00 TTL=255
> ID=0 DF PROTO=TCP SPT=5554 DPT=4715 WINDOW=0 RES=0x00 ACK RST URGP=0 ]
Snippet of the original packet which this ICMP error is referring to (a TCP
packet from 1.2.3.4 to 219.141.107.<snip>, from source port 5554 to
destination port 4715, with the reset flag set, therefore something was
obviously trying to terminate an already-established connection).
See http://logi.cc/linux/netfilter-log-format.php3 for more details on
netfilter's logging format.
Regards,
Antony.
--
There are only 10 types of people in the world:
those who understand binary notation,
and those who don't.
Please reply to the list;
please don't CC me.
prev parent reply other threads:[~2004-06-07 15:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-06-07 14:52 Log question Michael Sams
2004-06-07 15:06 ` Antony Stone [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200406071606.37187.Antony@Soft-Solutions.co.uk \
--to=antony@soft-solutions.co.uk \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox