Hi,

After some recent maintenance work on our Bering 1.2 box, shorewall.log
has begun showing strange connection attempts from local adresses
in the network range 10.1.1.x to our ISP allocated IP address.

Any ideas what can be the cause of this? None of the internal hosts 
use this address range, neither does any service (I know about) on
Bering...

Thank you,
Shango Oluwa.


Below is a sample of shorewall.log with our allocated IP replaced
as a.b.c.d:

SRC=10.1.1.55 DST=a.b.c.d LEN=40 TOS=00 PREC=0x00 TTL=52 ID=0 DF
PROTO=TCP SPT=80 DPT=9872 SEQ=2592007791 ACK=0 WINDOW=0 RST URGP=0 
Mar 16 18:55:55 jungla Shorewall:rfc1918:DROP: IN=ppp0 OUT= MAC=71:10:
SRC=10.1.1.76 DST=a.b.c.d LEN=40 TOS=00 PREC=0x00 TTL=52 ID=0 DF
PROTO=TCP SPT=80 DPT=9185 SEQ=2566522239 ACK=0 WINDOW=0 RST URGP=0 
Mar 16 18:55:56 jungla Shorewall:rfc1918:DROP: IN=ppp0 OUT= MAC=71:10:
SRC=10.1.1.90 DST=a.b.c.d LEN=40 TOS=00 PREC=0x00 TTL=51 ID=0 DF
PROTO=TCP SPT=80 DPT=61639 SEQ=2573827886 ACK=0 WINDOW=0 RST URGP=0 
Mar 16 18:55:56 jungla Shorewall:rfc1918:DROP: IN=ppp0 OUT= MAC=71:10:
SRC=10.1.1.55 DST=a.b.c.d LEN=40 TOS=00 PREC=0x00 TTL=52 ID=0 DF
PROTO=TCP SPT=80 DPT=9325 SEQ=2591973530 ACK=0 WINDOW=0 RST URGP=0 
Mar 16 18:55:57 jungla Shorewall:rfc1918:DROP: IN=ppp0 OUT=




-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
------------------------------------------------------------------------
leaf-user mailing list: [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-user
SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html

Reply via email to