Re: TV Card setup (repost) - baskitcaise, help please! :-)

From: Hactar (ebenONE_at_tampabay.ARE-ARE.com.unmunge)
Date: 10/04/04 

Date: Mon, 04 Oct 2004 02:46:18 GMT

In article <415e8d8e@duster.adelaide.on.net>, JPB <jpb@email.pt> wrote:
> baskitcaise wrote:
> > JPB adjusted his/her tin foil beanie and asbestos underwear to write:
> >
> >>"Oct 2 10:23:35 amd kernel: SFW2-INext-ACC-TCP IN=eth1 OUT=
> >>MAC=00:40:f4:29:04:c4:00:90:1a:40:bd:ac:08:00 SRC=193.217.226.190
> >>DST=203.122.244.179 LEN=48 TOS=0x00 PREC=0x20 TTL=103 ID=2755 DF
> >>PROTO=TCP SPT=13673 DPT=6600 WINDOW=65535 RES=0x00 SYN URGP=0 OPT
> >>(0204058C01010402)"
> >
> >
> > These are messages from your firewall and can get a bit out of hand the
> > source is 193.217.226.190 destination 203.122.244.179, is the first
> > number your DNS server by any chance?
>
> No idea, really...I confess I am a bit green when it comes to these
> things...

I'm going to try to make it readable, but my knowlege of this is spotty:

MAC=00:40:f4:29:04:c4:00:90:1a:40:bd:ac:08:00

MAC ID "Media access card identification" Usually only 6 bytes long (six
pair of hex digits separated by colons, every MAC ID is unique, it's printed
on the card) but this is 12 pairs. I don't know what's up.

SRC=193.217.226.190

"Source". Where the packet's from.

DST=203.122.244.179

"Destination". Where the packet's to.

LEN=48

"Length" of IP packet. Min=40 bytes.

TOS=0x00

"Type of service". Unused?

PREC=0x20

?

TTL=103

"Time to live". Decremented by 1 by each router it passes.

ID=2755

?

DF

"Don't fragment" this IP packet if it's too big, drop it and send an ICMP
error.

PROTO=TCP

"Protocol" is TCP, not UDP or some other.

SPT=13673

"Source port". Ports <1024 require root privs on a *nix box.

DPT=6600

"Destination port". grep 6600 /etc/services ... heck if I know. 6000 is X,
so it might be related to that.

WINDOW=65535

Window size?

RES=0x00

?

SYN

As in, part of the 3-way handshake?

URGP=0

Urgent?

OPT

?

> The second number belongs to my ISP, but the first one, when looked up
> on reverse DNS lookup site, resolves as "revertdist-adsl.dax.net" -

JPB's machine

> which is something I've never heard of, and when attempting to contact
> that site, it gives out "connection refused". I can ping it, but that's
> all.

He's not running any services that you know about.

> My firewall settings in Yast are set up to log critical lost packets,
> but I have no idea what the message above may relate to...

Timing may yield a clue. 

-- 
-eben    ebQenW1@EtaRmpTabYayU.rIr.OcoPm    home.tampabay.rr.com/hactar
CAPRICORN:  The stars say you're an exciting and wonderful person...
but you know they're lying.  If I were you, I'd lock my doors and
windows and never never never never leave my house again.  -- Weird Al

Relevant Pages

  • Re: Kerio PFW 2.14 - Safe?
    ... >> down user interface. ... Then consider the fact that most packet ... If Kerio 'X' says it's stateful it most ... >> way to know for sure would be to stand between the firewall and the ...
    (comp.security.firewalls)
  • Re: Firewall questions -- what is ...?
    ... packet payload inspection. ... IDS is not a firewall and does not necessarily protect you. ... port number for a well known service and the destination port is above 1023, ... Firewalls and IDS are prone to frequent false alarms. ...
    (microsoft.public.security)
  • Re: Creating a simple windows messaging app
    ... a broker app that receives packets from a canbus and pushes them out to ... each application thread a copy of the packet. ... consists of putting the message into a queue to be sent to the bus (no ... targeted at a specific window. ...
    (microsoft.public.vc.mfc)
  • Re: xp firewall and what it should do.
    ... >> I have windows xp firewall enabled but continue to be ... >Internet popups (meaning they are in Internet Explorer ... >browser window with pure crap floating in it you did not ... >Open Network Connections ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Max iptables rules?
    ... Here is my understanding of how Iptables processes firewall rules, ... Lets say the above is our firewall with 1000 rules in it. ... The packet will be compared to the list. ... On the 3rd rule, iptables will find a match and will allow the packet, ...
    (comp.security.firewalls)