Re: help with log entries

[David M. Fetter]

It looks like those external ip addresses are being denied by your 
firewall to connect to the inside.  All the from ports are 110 which is 
pop email, so it's almost like those people are trying to send relay 
traffic or something over your connection, but again it's being denied.

[EMAIL PROTECTED] wrote:
Hi,

I am getting some confusing log entries from my Cisco Pix firewall. At
first I thought that it was a network problem but I don't have any other
evidence to support that assumption.
The log entries look like this. Destination IP addresses changed....

Feb 26 15:32:49 firewall %PIX-6-106015: Deny TCP (no connection) from 
161.58.238.151/110 to a.b.c.d/3782 flags RST ACK  on interface outside
Feb 26 15:32:50 firewall %PIX-6-106015: Deny TCP (no connection) from 
161.58.238.151/110 to a.b.c.d/3783 flags RST PSH ACK  on interface 
outside
Feb 26 15:32:50 firewall %PIX-6-106015: Deny TCP (no connection) from 
200.24.76.3/110 to a.b.c.d/3796 flags RST ACK  on interface outside
Feb 26 15:32:51 firewall %PIX-6-106015: Deny TCP (no connection) from 
200.24.76.8/110 to a.b.c.d/3768 flags RST ACK  on interface outside
Feb 26 15:33:02 firewall %PIX-6-106015: Deny TCP (no connection) from 
66.35.250.206/59231 to 10.10.10.4/25 flags RST  on interface outside
Feb 26 15:33:02 firewall %PIX-6-106015: Deny TCP (no connection) from 
66.35.250.206/59231 to 10.10.10.4/25 flags RST  on interface outside
Feb 26 15:33:04 firewall %PIX-6-106015: Deny TCP (no connection) from 
66.35.250.206/59231 to 10.10.10.4/25 flags RST PSH ACK  on interface 
inside
Feb 26 15:33:46 firewall %PIX-6-106015: Deny TCP (no connection) from 
161.58.238.151/110 to a.b.c.d/3843 flags RST ACK  on interface outside
Feb 26 15:33:46 firewall %PIX-6-106015: Deny TCP (no connection) from 
161.58.238.151/110 to a.b.c.d/3845 flags RST ACK  on interface outside
Feb 26 15:33:46 firewall %PIX-6-106015: Deny TCP (no connection) from 
161.58.238.151/110 to a.b.c.d/3847 flags RST ACK  on interface outside
Feb 26 15:33:46 firewall %PIX-6-106015: Deny TCP (no connection) from 
161.58.238.151/110 to a.b.c.d/3846 flags RST ACK  on interface outside
Feb 26 15:33:48 firewall %PIX-6-106015: Deny TCP (no connection) from 
200.24.76.8/110 to a.b.c.d/3830 flags RST ACK  on interface outside
Feb 26 15:33:51 firewall %PIX-6-106015: Deny TCP (no connection) from 
200.24.76.3/110 to a.b.c.d/3860 flags RST ACK  on interface outside

If anyone has any clues or suggestions I would be most grateful!







--
David M. Fetter - http://www.fetterconsulting.com/
"The world is full of power and energy and a person can go far by just 
skimming off a tiny bit of it." Neal Stephenson - Snow Crash