Re: OT: Deciphering log entry(iptables)

[Chris Green <cmg () sourcefire com>]

> > Has anyone seen this or know what it may be
> > related to?
> >
> > Mar 31 04:19:35 xxxxfw1 kernel: IN= OUT=eth0
> > SRC=aa.bb.cc.ddd(me) DST=aa.bb.ee.ff(them)
> > LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF
> > PROTO=TCP SPT=80 DPT=2418 WINDOW=0
> > RES=0x00 ACK RST URGP=0


It's very possible that someone is synflooding someone else using your
IP as the spoofed src.

-- 
Chris Green <cmg () sourcefire com>
Fame may be fleeting but obscurity is forever.


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users