search for: 64240

Hello, when I execute "shorewall hits" command I find this stats: HITS IP DATE ---- --------------- ------ 92099 192.168.0.2 Nov 24 7764 59.104.107.85 Nov 23 3997 192.168.1.77 Nov 24 337 181.50.93.89 Nov 23 331 59.104.156.68 Nov 23 315 99.109.157.73 Nov 23 301 190.225.157.40 Nov 23 275 179.153.183.53 Nov 23 268

...nuation to #230] netbios-ssn > 1121 [ACK] Seq=197355 Ack=1574 Win=27872 [CHECKSUM INCORRECT] Len=1460 236 1.712064 Sarge XP SMB [TCP Retransmission] Read AndX Response, 61440 bytes 237 1.712817 XP Sarge TCP 1121 > netbios-ssn [ACK] Seq=1574 Ack=198815 Win=64240 Len=0 238 1.712876 Sarge XP TCP [Continuation to #236] netbios-ssn > 1121 [ACK] Seq=198815 Ack=1574 Win=27872 [CHECKSUM INCORRECT] Len=1460 239 1.712892 Sarge XP TCP [Continuation to #236] netbios-ssn > 1121 [ACK] Seq=200275 Ack=1574 Win=27872 [CHECKSUM I...

...mba appears deaf) ***** 86 0.13346 winclient -> sambaserver ICMP Echo request (ID: 512 Sequence number: 20225) 87 0.00004 sambaserver -> winclient ICMP Echo reply (ID: 512 Sequence number: 20225) 88 0.00035 winclient -> sambaserver TCP D=445 S=4549 Syn Seq=416819196 Len=0 Win=64240 Options=<mss 1460,nop,nop,sackOK> 89 0.00004 sambaserver -> winclient TCP D=4549 S=445 Rst Ack=416819197 Win=0 91 0.01047 winclient -> sambaserver ICMP Echo request (ID: 512 Sequence number: 20481) 92 0.00004 sambaserver -> winclient ICMP Echo reply (ID: 512 Sequence n...

...; 86 0.13346 winclient -> sambaserver ICMP Echo request (ID: 512 > Sequence number: 20225) > 87 0.00004 sambaserver -> winclient ICMP Echo reply (ID: 512 Sequence > number: 20225) > 88 0.00035 winclient -> sambaserver TCP D=445 S=4549 Syn > Seq=416819196 Len=0 Win=64240 Options=<mss 1460,nop,nop,sackOK> > 89 0.00004 sambaserver -> winclient TCP D=4549 S=445 Rst > Ack=416819197 Win=0 > 91 0.01047 winclient -> sambaserver ICMP Echo request (ID: 512 > Sequence number: 20481) > 92 0.00004 sambaserver -> winclient ICMP Echo repl...

...h and the packets are dropped but i have at the top of my rules an accept. the configuration looks like: rules-file: ----------- ACCEPT net fw tcp 22 - TCPDUMP-log: ------------ 12:16:08.153934 84.153.98.30.1322 > [my-destination-machine].ssh: S 3717288415:3717288415(0) win 64240 <mss 1412,nop,nop,sackOK> (DF) [tos 0x10] SYSLOG-log: ----------- Mar 4 12:16:08 [kernel] Shorewall:logdrop:DROP:IN=ppp0 OUT= MAC= SRC=84.153.98.30 DST=[my-destination-machine] LEN=48 TOS=0x10 PREC=0x00 TTL=125 ID=59988 DF PROTO=TCP SPT=1322 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0 i can co...

...but no drop of the packages: #tcpdump port 8080 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 15:07:21.522898 IP 158.226.150.44.musiconline > iacapp3.local.http-alt: S 3628241160:3628241160(0) win 64240 <mss 1460,nop,nop,sackOK> 15:07:24.440701 IP 158.226.150.44.musiconline > iacapp3.local.http-alt: S 3628241160:3628241160(0) win 64240 <mss 1460,nop,nop,sackOK> 15:07:30.456696 IP 158.226.150.44.musiconline > iacapp3.local.http-alt: S 3628241160:3628241160(0) win 64240 <mss 146...

...Use is subject to license terms. Assembled 19 November 2008 Below is the output from snoop. 10.0.1.200 is the Solaris server and 10.0.1.4 is the Mac client. 10.0.1.200 -> 10.0.1.4 TCP D=51683 S=3260 Push Ack=405482834 Seq=1072298406 Len=2352 Win=64240 10.0.1.200 -> 10.0.1.4 TCP D=51683 S=3260 Push Ack=405482834 Seq=1072300758 Len=4390 Win=64240 10.0.1.200 -> 10.0.1.4 TCP D=51683 S=3260 Push Ack=405482834 Seq=1072305148 Len=2920 Win=64240 10.0.1.200 -> 10.0.1.4 TCP D=51683 S=3260 Push Ack=405482834 Seq=1072308068 Len=17...

...REC=0x00 TTL=101 ID=33882 PROTO=UDP SPT=1171 DPT=1434 LEN=384 Jan 27 01:19:46 h0000b49d5510 kernel: Shorewall:blacklst:DROP:IN=eth0 OUT= MAC=00:00:b4:9d:55:10:00:05:9a:d6:f0:54:08:00 SRC=208.251.137.94 DST=192.168.0.1 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=41886 DF PROTO=TCP SPT=4603 DPT=1411 WINDOW=64240 RES=0x00 SYN URGP=0 Jan 27 01:19:49 h0000b49d5510 kernel: Shorewall:blacklst:DROP:IN=eth0 OUT= MAC=00:00:b4:9d:55:10:00:05:9a:d6:f0:54:08:00 SRC=208.251.137.94 DST=192.168.0.1 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=41918 DF PROTO=TCP SPT=4603 DPT=1411 WINDOW=64240 RES=0x00 SYN URGP=0 Jan 27 01:19:5...

...ts 0) a example tcpdump: # tcpdump -v port 8099 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 13:19:25.340470 IP (tos 0x0, ttl 63, id 31421, offset 0, flags [DF], length: 48) 158.226.150.44.4870 > iacapp3.local.8099: S [tcp sum ok] 2049470510:2049470510(0) win 64240 <mss 1460,nop,nop,sackOK> 13:19:25.341584 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], length: 48) iacapp3.local.8099 > 158.226.150.44.4870: S [tcp sum ok] 1753072926:1753072926(0) ack 2049470511 win 5840 <mss 1460,nop,nop,sackOK> 13:19:25.341042 IP (tos 0x0, ttl 63, id 31422,...

...:IN=eth0 OUT=eth1 SRC=222.88.173.5 DST=216.37.35.220 LEN=1484 TOS=0x00 PREC=0x00 TTL=107 ID=8116 PROTO=UDP SPT=27613 DPT=1026 LEN=1464 Aug 26 23:30:54 net2all:DROP:IN=eth0 OUT=eth1 SRC=66.90.155.122 DST=216.37.35.219 LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=9928 DF PROTO=TCP SPT=3391DPT=1433 WINDOW=64240 RES=0x00 SYN URGP=0 Aug 26 23:30:54 net2all:DROP:IN=eth0 OUT=eth1 SRC=66.90.155.122 DST=216.37.35.220 LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=9936 DF PROTO=TCP SPT=3395DPT=1433 WINDOW=64240 RES=0x00 SYN URGP=0 Aug 26 23:30:54 net2all:DROP:IN=eth0 OUT= SRC=66.90.155.122 DST=216.37.35.222 LEN=48 TOS=...

...172.20.242.2.hsrp > 224.0.0.102.hsrp: HSRPv1 03:09:52.309577 IP 172.20.241.3.hsrp > 224.0.0.102.hsrp: HSRPv1 03:09:52.309808 IP 172.20.242.3.hsrp > 224.0.0.102.hsrp: HSRPv1 03:09:52.972411 IP 10.213.132.83.63941 > dev-130.odc.reconnex.net.ssh: P 394076964:394077016(52) ack 409177358 win 64240 03:09:52.972431 IP dev-130.odc.reconnex.net.ssh > 10.213.132.83.63941: . ack 52 win 10720 03:09:52.972556 IP dev-130.odc.reconnex.net.ssh > 10.213.132.83.63941: P 1:53(52) ack 52 win 10720 03:09:52.972726 IP dev-130.odc.reconnex.net.ssh > 10.213.132.83.63941: P 53:201(148) ack 52 win 10720...

...ges: > #tcpdump port 8080 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes > 15:07:21.522898 IP 158.226.150.44.musiconline > iacapp3.local.http-alt: S > 3628241160:3628241160(0) win 64240 <mss 1460,nop,nop,sackOK> > 15:07:24.440701 IP 158.226.150.44.musiconline > iacapp3.local.http-alt: S > 3628241160:3628241160(0) win 64240 <mss 1460,nop,nop,sackOK> > 15:07:30.456696 IP 158.226.150.44.musiconline > iacapp3.local.http-alt: S > 3628241160:3628241160(0) w...

Monitoring a tcpdump between two systems, a FreeBSD 9.1 system has the following interface: msk0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=c011b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,TSO4,VLAN_HWTSO,LINKSTATE> ether 00:11:2f:2a:c7:03 inet 10.0.1.199 netmask 0xffffff00 broadcast 10.0.1.255 inet6 fe80::211:2fff:fe2a:c703%msk0 prefixlen 64 scopeid

...name = nas1 workgroup = home server string = FreeNAS Server security = share dns proxy = no # Settings to enhance performance: use sendfile = yes strict locking = no read raw = yes write raw = yes oplocks = yes max xmit = 65535 deadtime = 15 getwd cache = yes socket options = TCP_NODELAY SO_SNDBUF=64240 SO_RCVBUF=64240 # End of performance section unix charset = UTF-8 store dos attributes = yes local master = yes time server = no guest account = ftp display charset = LOCALE max log size = 10 syslog only = yes syslog = 1 load printers = no printing = bsd printcap name = /dev/null disable spoolss =...

...ne I have a few machines, of which one is the webserver. Checking the logfile I see the following messages: Aug 30 21:24:16 gatekeeper kernel: Shorewall:rfc1918:DROP:IN=eth1 OUT=eth0 SRC=84.119.226.171 DST=192.168.0.50 LEN=48 TOS=0x00 PREC=0x00 TTL=123 ID=14912 DF PROTO=TCP SPT=2198 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0 It seems that he is trying to access my internal ip adress immediately, right? But when he ping of nslookups the website with the name (meuk.planjer.com) he gets the external ipadress. What could be wrong with my or his setup? regars, Felix

...own things to just an example user as the actual config is over 1K lines. # Samba 4 config [global] workgroup = BLKG server string = PDC encrypt passwords = Yes null passwords = true log level = 2 max log size = 5000 socket options = TCP_NODELAY SO_RCVBUF=64240 SO_SNDBUF=64240 use sendfile = yes load printers = no wins support = yes security = user domain master = yes local master = yes preferred master = yes domain logons = yes username map = /usr/local/etc/smbusers passdb backend = smbpasswd...

...config is over 1K lines. > > # Samba 4 config > [global] > workgroup = BLKG > server string = PDC > encrypt passwords = Yes > null passwords = true > log level = 2 > max log size = 5000 > socket options = TCP_NODELAY SO_RCVBUF=64240 SO_SNDBUF=64240 > use sendfile = yes > load printers = no > wins support = yes > security = user > domain master = yes > local master = yes > preferred master = yes > domain logons = yes > username map = /usr/local/etc...

...00 (C): (B) at <IP of X> port 34998 options 700000c socket 12 status 100 (A) at <IP of Y> port 32820 options 700000c socket 9 status 100 tshark capture on (A) of "curl 10.0.0.1" from (A) > 1 0.000000000 10.0.0.2 → 10.0.0.1 TCP 60 46736 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3299780639 TSecr=0 WS=128 > 2 0.039290163 10.0.0.1 → 10.0.0.2 TCP 60 80 → 46736 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1385 SACK_PERM=1 TSval=3219761779 TSecr=3299780639 WS=64 > 3 0.039333808 10.0.0.2 → 10.0.0.1 TCP 52 46736 → 80 [A...

...WORKGROUP server string = nas.lan.jcom.net.au security = share dns proxy = no # Settings to enhance performance: use sendfile = yes strict locking = no read raw = yes write raw = yes oplocks = yes max xmit = 65535 deadtime = 15 getwd cache = yes socket options = IPTOS_LOWDELAY TCP_NODELAY SO_SNDBUF=64240 SO_RCVBUF=64240 # End of performance section unix charset = UTF-8 store dos attributes = yes local master = yes time server = no guest account = root display charset = LOCALE max log size = 10 syslog only = no syslog = 10 load printers = no printing = bsd printcap name = /dev/null disable spoolss =...

...bin/PrintServiceAccess release %p %j client ntlmv2 auth = yes domain logons = no lpq command = /usr/sbin/PrintServiceAccess jobs %p passdb backend = opendirectorysam guest dos charset = CP437 unix charset = UTF-8-MAC socket options = SO_RCVBUF=64240 auth methods = guest ntdomain opendirectory local master = no use spnego = yes map to guest = Bad User domain master = no printer admin = @admin, @staff log level = 3 [AppDeployment] oplocks = 0 map archive = no path...