Re: Re: interpreting pfsense(ntop) on wan

[securityfocus () thedaileyplanet com]

NTOP will report the frame whenever it is seen on the interface you are monitoring... it does not 'ask' pfsense if it 
blocked it or forwarded it.  You might try listening on an inside interface instead of your WAN interface to reduce the 
noise factor.

You don't mention if 198.51.100.0/24 is your inside address block or your WAN address block...

If 198.51.100.0/24 is inside, then NTOP is telling you that 203.0.113.25 did indeed establish four sessions to .123... 
otherwise it appears that you're on a hub or a mirror port (or just picking up fastpath switching noise) and seeing 
these sessions being created.

A bit more knowledge of your pfsense box setup would be more helpful to discern good vs evil.


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------