Security Incidents mailing list archives

Port 6502


From: sekure () MEDIAONE NET (Tony Lambiris)
Date: Mon, 17 Apr 2000 00:55:10 -0400


Check out these log messages...

Apr 16 20:35:21 sekure kernel: Packet log: input DENY eth0 PROTO=17
192.168.1.1:
6502 255.255.255.255:6502 L=136 S=0x00 I=64 F=0x0000 T=128 (#4)
Apr 16 20:35:21 sekure kernel: Packet log: input DENY eth0 PROTO=17
192.168.1.1:
6502 255.255.255.255:6502 L=136 S=0x00 I=65 F=0x0000 T=128 (#4)
Apr 16 20:35:21 sekure kernel: Packet log: input DENY eth0 PROTO=17
192.168.1.1:
6502 255.255.255.255:6502 L=136 S=0x00 I=66 F=0x0000 T=128 (#4)
Apr 16 20:35:21 sekure kernel: Packet log: input DENY eth0 PROTO=17
192.168.1.1:
6502 255.255.255.255:6502 L=136 S=0x00 I=67 F=0x0000 T=128 (#4)
Apr 16 20:35:21 sekure kernel: Packet log: input DENY eth0 PROTO=17
192.168.1.1:
6502 255.255.255.255:6502 L=136 S=0x00 I=68 F=0x0000 T=128 (#4)

I'm running a Debian system, with ipmasq (the scripts to put up dynamic
firewalls) installed, and in one of the scripts, it denys any requests
for private IP addresses that come from the external network interface.
Well, in my case, eth0 is in fact connected to the internet, and the
address it's trying to reach is 192.168.1.1. I'm just confused about the
source address being 255.255.255.255. Can some one shed light on this
(especially whats on port 6502... nothing in my /etc/services).

Thanks.


Current thread: