Re: Problem with log for loopback address

2004-01-12 Thread Laurent Cheylus
Hi, On Fri, 9 Jan 2004, Can Erkin Acar wrote: Sorry Daniel but those packets are incoming packets from 127.0.0.1 for my external interface. Perhaps they are dropped during scrubbing? I have done some tests without 'scrub' rule (scrub in all in my pf.conf) but the incoming packets from

Re: Problem with log for loopback address

2004-01-12 Thread Trevor Talbot
On Monday, Jan 12, 2004, at 08:05 US/Pacific, Laurent Cheylus wrote: I have done some tests without 'scrub' rule (scrub in all in my pf.conf) but the incoming packets from 127.0.0.1 for my external address are not logged either. ip_input() drops packets with 127/8 in either address field when

Re: Problem with log for loopback address

2004-01-09 Thread Can Erkin Acar
On Fri, Jan 09, 2004 at 12:41:45PM +0100, Laurent Cheylus wrote: I have a problem with PF logs on OpenBSD 3.4-stable version. I received a lot of packets from loopback addresse 127.0.0.1 port 80 : - - TCP RST packets sent by clients infected by Blaster Worm and use of my personnal

Re: Problem with log for loopback address

2004-01-09 Thread Laurent Cheylus
Hi, On Fri, 9 Jan 2004, Daniel Hartmeier wrote: Why do you assume those are incoming packets? Might as well be _outgoing_ packets, with you being the one sending out packets with unroutable source addresses. That would explain all inconsistencies you mention, assuming you're passing such

Re: Problem with log for loopback address

2004-01-09 Thread Can Erkin Acar
On Fri, Jan 09, 2004 at 03:30:37PM +0100, Laurent Cheylus wrote: Hi, On Fri, 9 Jan 2004, Daniel Hartmeier wrote: Why do you assume those are incoming packets? Might as well be _outgoing_ packets, with you being the one sending out packets with unroutable source addresses. That would