> Mar 28 00:02:31 rosahas kernel: Packet log: input DENY
> eth0 PROTO=17 24.5.117.188:513 24.5.117.255:513 L=136
> S=0x00 I=10066 F=0x0000 T=64 (#40)
> .
> .
> .
> Mar 28 02:11:35 rosahas kernel: Packet log: input DENY
> eth0 PROTO=17 24.5.117.188:513 24.5.117.255:513 L=160
> S=0x00 I=39885 F=0x0000 T=64 (#40)
>
Those are broadcasts on the attached LAN going to the 'who' port, 513 UDP.
Is this rwho?
> The log is for the I in the range of 10066 to 39885,
> it adds like over 25-30 lines of the same stuff
> incrementing the I= value.
>
That's the IP ID that's incrementing and that's perfectly normal.
> Can someone please explain me what this is?
>
I guess one of your boxes, probably a UNIX machine of some sort, is issuing
rwho broadcast requests, but I could be off base.
HTH,
Tobias
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
