I have my Mandrake 6.0 box hooked up to my cable modem and leave it on 24/7. I
am running pmfirewall and think it is "pretty secure".
I have noticed lately in my log files the following packet always getting
denied.
input DENY eth0 PROTO=17 24.XX.24.84:402 225.XX.2.3:402 L=72 S=0x00 I=32002
F=0x0000 T=31 (#27)
I placed the "XX" in the source and dest IP's to block it. Neither is
my IP. The first IP (the 24.XX.24.84 is definitely an IP of another RR user)
the other is not mine and obviously outside the RR network.
The best I can determine this is a UDP packet on port 402. I looked up that
port # and it is listed as "Genie". I have no idea what this is.
The reason I am asking here is for the last few days I have been getting this
in my logs every 1 minute on the nose.
I don't want to complain to RR if this is something stupid, but if it is a user
trying to get into my system, I will report it.
Any thoughts?
--
Mike Hill
[EMAIL PROTECTED]
