Re: OT: Deciphering log entry(iptables)

[Matt Kettler <mkettler () evi-inc com>]

You said there was no outbound syn packet.. but in this case I suspect 
there would be an *inbound* syn...

This would appear that someone tried to connect to a webserver on your 
machine, and your machine responded with a reset since it was not running one.

This is extraordinarily common due to the number of web-server infecting 
worms floating around.

typical expected sequence to generate this:

someone:someport -> you:80 syn

you:80 -> someone:someport rst   - "get lost buddy."


or possibly:

someone_running_portscaners:someport -> you:80   (no flags, fake fin/ack, 
or a xmas tree)

you:80 -> someone:someport rst   - "get lost buddy."

Of course what kinds of traffic would generate a RST instead of an ICMP 
error message will vary with how you have iptables configured.


At 09:24 AM 4/2/2002 -0800, you wrote:
> This isn't related to snort (yet) I havn't
> installed it on this network. I was going
> through my log files on this firewall and have a
> ton(literally) of this entry. The only thing
> that changes is the destination ip's last two
> octets. eth0 is the external interface. There is
> no initiating SYN packet out bound.(that I know
> of need to run tcpdump on it for a bit)
> Has anyone seen this or know what it may be
> related to?
>
> Mar 31 04:19:35 xxxxfw1 kernel: IN= OUT=eth0
> SRC=aa.bb.cc.ddd(me) DST=aa.bb.ee.ff(them)
> LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF
> PROTO=TCP SPT=80 DPT=2418 WINDOW=0
> RES=0x00 ACK RST URGP=0
>
> Cheers,
>   Scott
>
> Oh yea, I think this is good for a drink or
> possibly two.
>
>
>
> THERE IS ONLY ONE...
> SOCCER.COM, The Center of the Soccer Universe
> http://www.soccer.com
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users