Re: stealth scans on old legacy firewalls.

[lim () VIPE TECHNION AC IL (Leonid Igolnik - LiM)]

|Feb 04 04:58:58.892 bertha kernel[0]: 226 IP  packet dropped
|(gnet44.szptt.net.cn[202.96.191.44]->bertha[xxx.xxx.xxx.xxx]:
|Protocol=TCP[SYN] Port 2225->3128): Restricted Port: Protocol=TCP[SYN] Port
|2225->3128 (received on interface xxx.xxx.xxx.xxx)
|
|^^^^^^ Dont know what they are looking for on port 3128.
3128 is default port for many proxys, squid is one example.

Leonid Igolnik aka LiM