[Snort-users] OT: Deciphering log entry(iptables)

Scott Taylor scottt at ...4859...
Tue Apr 2 09:37:45 EST 2002


This isn't related to snort (yet) I havn't 
installed it on this network. I was going 
through my log files on this firewall and have a 
ton(literally) of this entry. The only thing 
that changes is the destination ip's last two 
octets. eth0 is the external interface. There is 
no initiating SYN packet out bound.(that I know 
of need to run tcpdump on it for a bit)
Has anyone seen this or know what it may be 
related to?

Mar 31 04:19:35 xxxxfw1 kernel: IN= OUT=eth0 
SRC=aa.bb.cc.ddd(me) DST=aa.bb.ee.ff(them) 
LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF 
PROTO=TCP SPT=80 DPT=2418 WINDOW=0 
RES=0x00 ACK RST URGP=0

Cheers,
  Scott

Oh yea, I think this is good for a drink or 
possibly two.



THERE IS ONLY ONE... 
SOCCER.COM, The Center of the Soccer Universe
http://www.soccer.com




More information about the Snort-users mailing list