> The log on my (new) firewall showed up a couple of dropped packets > from 80.130.244.51. > > Full log entries look like: > > Sep 23 09:02:04 bigdog kernel: Shorewall:net2all:DROP:IN=ppp0 OUT= > MAC= SRC=80.130.244.51 DST=198.142.249.100 LEN=48 TOS=0x10 PREC=0x00 > TTL=115 ID=8481 DF PROTO=TCP SPT=4430 DPT=21 WINDOW=64800 RES=0x00 SYN > URGP=1536 > > Sep 23 09:02:13 bigdog kernel: Shorewall:net2all:DROP:IN=ppp0 OUT= > MAC= SRC=80.130.244.51 DST=198.142.249.100 LEN=48 TOS=0x10 PREC=0x00 > TTL=115 ID=9138 DF PROTO=TCP SPT=4430 DPT=21 WINDOW=64800 RES=0x00 SYN > URGP=0
This ip looks to be attempting to connect with DPT=21, aka destination port 21 on your ppp0 interface. And as you know port 21 tcp = ftp service Thanks -- SLUG - Sydney Linux User's Group - http://slug.org.au/ More Info: http://lists.slug.org.au/listinfo/slug
