Essa é a saída do comando que vc passou, e falando nisso, pode explicar mais sobre o comando citado? Obrigado.
@2 block return log all @20 pass in log quick on re2 inet proto tcp from any to any port = rdp flags S/SA keep state queue pri5up @21 pass in log quick on re2 inet proto tcp from any to any port = 8080 flags S/SA keep state queue pri5up @22 pass in quick on re2 inet proto tcp from any to (re2:1) port = smtp flags S/SA keep state queue pri5up @23 pass in quick on re2 inet proto tcp from any to (re2:1) port = pop3 flags S/SA keep state queue pri5up @24 pass in quick on re2 inet proto tcp from any to (re2:1) port = smtps flags S/SA keep state queue pri5up @25 pass in quick on re2 inet proto tcp from any to (re2:1) port = pop3s flags S/SA keep state queue pri5up @26 pass in quick on re2 inet proto tcp from any to (re2:1) port = rdp flags S/SA keep state queue pri5up @27 pass in quick on re2 inet proto tcp from any to (re2:1) port = 8080 flags S/SA keep state queue pri5up @28 pass in quick on re2 inet proto udp from any to any port = domain keep state queue pri5up @29 pass in quick on re2 inet proto udp from any to any port = 3389 keep state queue pri5up Em 11 de dezembro de 2014 12:07, Fernando Gilli <[email protected]> escreveu: > > Em 11 de dezembro de 2014 10:56, joao jamaicabsd <[email protected]> > > escreveu: > > > > > Bom dia pessoal. > > > Estou rodando um tcpdump e estou notando uma grande quantidade de > bloquei > > > de tráfego UDP, alguém pode me ajudar a desvendar isso? Segue: > > > > > > block in on re1: 192.168.0.22.59087 > 74.102.93.218.33709: UDP, > length 18 > > > > > > 10:51:13.322468 rule 2..16777216/0(match):block in on re1: > > > 192.168.0.22.59087 > 183.81.63.14.51113: UDP, length 18 > > > > > > 10:51:13.322544 rule 2..16777216/0(match): block in on re1: > > > 192.168.0.22.59087 > 76.70.77.89.22428: UDP, length 18 > > > > > > 10:51:13.322607 rule 2..16777216/0(match): block in on re1: > > > 192.168.0.22.59087 > 182.164.149.225.18070: UDP, length 18 > > > > > > 10:51:14.055326 rule 2..16777216/0(match): block in on re2: > > > 189.58.79.200.36646 > 10.1.1.254.59087: UDP, length 28 > > > > > > 10:51:14.108374 rule 2..16777216/0(match): block in on re0: > > > 172.16.1.11.51507 > 8.8.4.4.53: 47222+ A? m.hotmail.com. (31) > > > > > > > > > > > > -- > > > E-mail: [email protected] > > > Aux Suporte de Sistemas (UNISUL) > > > E-mail: [email protected] > > > MSN: [email protected] > > > Cel: (48) 9144 2326 > > > ------------------------- > > João, deve ter uma regra "block in log" para todos udp > > Roda ai e ve que regra é essa: > > $ pfctl -vvs rules | grep @2 > > eu deixo passar apenas dns o resto netbios etc bloqueio tudo, porem sem > log > > > -- > Fernando Gilli > > ------------------------- > Histórico: http://www.fug.com.br/historico/html/freebsd/ > Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd > -- E-mail: [email protected] Aux Suporte de Sistemas (UNISUL) E-mail: [email protected] MSN: [email protected] Cel: (48) 9144 2326 ------------------------- Histórico: http://www.fug.com.br/historico/html/freebsd/ Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
