[linux] ipchains logy

[Oskar Stolc]

Čaute,


od určitého času (odkedy som nahodil filtrovanie paketov :-) ) sa mi objavujú
v logoch nasledovné hlášky:

Feb  5 06:13:20 computer kernel: Packet log: input DENY eth0 PROTO=2 1.2.3.4:65535 224.0.1.113:65535 L=32
+S=0x00 I=22 F=0x0000 T=1 O=0x00000494 (#16)
Feb  5 06:13:20 computer kernel: Packet log: input DENY eth0 PROTO=2 1.2.3.4:65535 227.37.32.1:65535 L=32
+S=0x00 I=23 F=0x0000 T=1 O=0x00000494 (#16)
Feb  5 06:13:20 computer kernel: Packet log: input DENY eth0 PROTO=2 1.2.3.4:65535 227.37.32.2:65535 L=32
+S=0x00 I=24 F=0x0000 T=1 O=0x00000494 (#16)
Feb  5 06:13:20 computer kernel: Packet log: input DENY eth0 PROTO=2 1.2.3.4:65535 227.37.32.3:65535 L=32
+S=0x00 I=25 F=0x0000 T=1 O=0x00000494 (#16)
Feb  5 06:13:20 computer kernel: Packet log: input DENY eth0 PROTO=2 1.2.3.4:65535 227.37.32.4:65535 L=32  +S=0x00 I=26 F=0x0000 T=1 O=0x00000494 (#16)
Feb  5 06:13:20 computer kernel: Packet log: input DENY eth0 PROTO=2 1.2.3.4:65535 227.37.32.5:65535 L=32
+S=0x00 I=27 F=0x0000 T=1 O=0x00000494 (#16)
Feb  5 06:13:20 computer kernel: Packet log: input DENY eth0 PROTO=2 1.2.3.4:65535 227.37.32.6:65535 L=32
+S=0x00 I=28 F=0x0000 T=1 O=0x00000494 (#16)
+S=0x00 I=256 F=0x0000 T=1 O=0x00000494 (#16)

pričom 1.2.3.4 je počítač z našej lokálky.

vie mi niekto povedať o čo ide? Aký že to port 65535? Som sa pozrel, PROTO=2
hovorí o tom, že sú to icmp pakety, ale ja ich mám
	ipchains -A input -p icmp -j ACCEPT
tak prečo to DENY?

Môže mi to niekto vysvetliť, resp poslať nejaké url? :-)

Pre to isté ip sa v logoch objavili nasledovné veci:

Feb  5 06:13:06 computer snort: Tiny Fragments - Possible Hostile Activity: 1.2.3.4 -> 1.2.255.255
Feb  5 06:15:17 computer snort: Tiny Fragments - Possible Hostile Activity: 1.2.3.4 -> 1.2.255.255
Feb  5 06:16:17 computer snort: Tiny Fragments - Possible Hostile Activity: 1.2.3.4 -> 1.2.255.255
Feb  5 06:17:51 computer snort: Tiny Fragments - Possible Hostile Activity: 1.2.3.4 -> 1.2.255.255
Feb  5 06:18:51 computer snort: Tiny Fragments - Possible Hostile Activity: 1.2.3.4 -> 1.2.255.255

kde 1.2.255.255 je broadcast našej lokálky.


čaute,


					Oskar