Two clues: 1. Port 110 is used by the POP3 email protocol.
2. A normal shutdown of a TCP connection is for one side to send a packet with the FIN flag set, which the other side acknowledges, then the other side sends a FIN which the first side acknowledges. RST is generally sent as a signal that the sending side is giving up the connection, often because of a timeout. This may mean that a FIN was sent but not received, or received but ignored. The PIX is a "stateful inspection" firewall, which means that it checks that incoming packets are part of an established connection. The "(no connection)" indicates that this check has failed for the packet. So what I expect you're seeing is that an internal client has been downloading mail from -- or port-scanning looking for a POP3 exploit -- 161.58.238.151 and 200.24.76.3 and 200.24.76.8, and has abandoned the connections (perhaps the exploit failed or their password was wrong). For some reason, the PIX has seen them drop the connection, or (more likely) has timed it out. Finally the server has timed it out, and it's the server "hanging up the phone" that the PIX is seeing and logging. The packets from 66.35.250.206 are something else. I've seen a client use RST to hang up on a server, but never three times as seen here. David Gillett > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: February 26, 2003 12:53 > To: [EMAIL PROTECTED] > Subject: help with log entries > > > Hi, > > I am getting some confusing log entries from my Cisco Pix firewall. At > first I thought that it was a network problem but I don't > have any other > evidence to support that assumption. > > The log entries look like this. Destination IP addresses changed.... > > Feb 26 15:32:49 firewall %PIX-6-106015: Deny TCP (no connection) from > 161.58.238.151/110 to a.b.c.d/3782 flags RST ACK on interface outside > Feb 26 15:32:50 firewall %PIX-6-106015: Deny TCP (no connection) from > 161.58.238.151/110 to a.b.c.d/3783 flags RST PSH ACK on interface > outside > Feb 26 15:32:50 firewall %PIX-6-106015: Deny TCP (no connection) from > 200.24.76.3/110 to a.b.c.d/3796 flags RST ACK on interface outside > Feb 26 15:32:51 firewall %PIX-6-106015: Deny TCP (no connection) from > 200.24.76.8/110 to a.b.c.d/3768 flags RST ACK on interface outside > Feb 26 15:33:02 firewall %PIX-6-106015: Deny TCP (no connection) from > 66.35.250.206/59231 to 10.10.10.4/25 flags RST on interface outside > Feb 26 15:33:02 firewall %PIX-6-106015: Deny TCP (no connection) from > 66.35.250.206/59231 to 10.10.10.4/25 flags RST on interface outside > Feb 26 15:33:04 firewall %PIX-6-106015: Deny TCP (no connection) from > 66.35.250.206/59231 to 10.10.10.4/25 flags RST PSH ACK on interface > inside > Feb 26 15:33:46 firewall %PIX-6-106015: Deny TCP (no connection) from > 161.58.238.151/110 to a.b.c.d/3843 flags RST ACK on interface outside > Feb 26 15:33:46 firewall %PIX-6-106015: Deny TCP (no connection) from > 161.58.238.151/110 to a.b.c.d/3845 flags RST ACK on interface outside > Feb 26 15:33:46 firewall %PIX-6-106015: Deny TCP (no connection) from > 161.58.238.151/110 to a.b.c.d/3847 flags RST ACK on interface outside > Feb 26 15:33:46 firewall %PIX-6-106015: Deny TCP (no connection) from > 161.58.238.151/110 to a.b.c.d/3846 flags RST ACK on interface outside > Feb 26 15:33:48 firewall %PIX-6-106015: Deny TCP (no connection) from > 200.24.76.8/110 to a.b.c.d/3830 flags RST ACK on interface outside > Feb 26 15:33:51 firewall %PIX-6-106015: Deny TCP (no connection) from > 200.24.76.3/110 to a.b.c.d/3860 flags RST ACK on interface outside > > If anyone has any clues or suggestions I would be most grateful! > >
