I recently started blocking spyware IP blocks using a rather large set of known spyware/adware block lists. That's working great. I've been keeping tabs on it's progress with the ipmon utility dumping into a private log file...
The majority of my "blocks" (~20/hour - not an alarming volume at least) are like these: 10/11/2004 22:54:45.778465 pppoe0 @1143:12 b 143.166.224.11,32776 -> 206.208.54.2,53 PR udp len 20 71 IN 10/11/2004 22:54:49.557109 pppoe0 @1064:76 b 64.124.229.165 -> 206.208.54.1 PR icmp len 20 52 icmp echo/0 IN 11/11/2004 03:35:28.337979 pppoe0 @1069:23 b 69.1.199.253,32769 -> 206.208.54.2,53 PR udp len 20 69 IN 11/11/2004 04:53:56.850667 pppoe0 @1143:12 b 143.166.83.13,32773 -> 206.208.54.2,53 PR udp len 20 82 IN 11/11/2004 03:56:14.068361 pppoe0 @1216:819 b 216.234.190.126 -> 206.208.54.46 PR icmp len 20 56 icmp unreach/port for 206.208.54.46,28106 - 216.234.190.126,1026 PR udp len 20 836 IN What puzzles me is that I'm getting them at all. My IP is in 65.196.xxx.yyy ????? Am I not reading this right? My DSL pppoe interface is receiving a packet (using the first line as an example) from: 143.166.224.11,port=32776, to: 206.208.54.2,port=53 Is there anyway to block all trafic in on pppoe0 that is not to *my* single IP? something like: block in quick on pppoe0 from any to %NOT% 65.196.xxx.yyy/32 ????? Comments/suggestions/discussion/enlightement/a clue? welcomed! 8-) gene
