Hi, folks: Could anyone please comment on MAC field in iptables log entry? Why does it have 14 bytes instead of 6 as it should be for Ethernet card MAC address? Or this field means something else? Also, since my firewall is being scanned, there are many entries in log file with different source IPs, yet the same MACs. Is there a way to trace the scanning host back? Thanks for whatever you may suggest. Below are a few log entries for your consideration: Feb 11 16:34:10 gateway kernel: IPT INPUT packet died: IN=eth0 OUT= MAC=00:50:04:a2:08:91:00:01:42:1b:57:20:08:00 SRC=80.117.120.207 DST=212.85.17.62 LEN=52 TOS=0x00 PREC=0x00 TTL=48 ID=21343 DF PROTO=TCP SPT=4504 DPT=57 WINDOW=60352 RES=0x00 SYN URGP=0 Feb 11 17:56:27 gateway kernel: IPT INPUT packet died: IN=eth0 OUT= MAC=00:50:04:a2:08:91:00:01:42:1b:57:20:08:00 SRC=61.139.69.22 DST=212.85.17.62 LEN=404 TOS=0x00 PREC=0x00 TTL=106 ID=51580 PROTO=UDP SPT=1305 DPT=1434 LEN=384 Feb 11 19:35:40 gateway kernel: IPT INPUT packet died: IN=eth0 OUT= MAC=00:50:04:a2:08:91:00:01:42:1b:57:20:08:00 SRC=204.31.160.26 DST=212.85.17.62 LEN=404 TOS=0x00 PREC=0x00 TTL=107 ID=14329 PROTO=UDP SPT=1367 DPT=1434 LEN=384 P.S. Many thanks to Ockar Andreasson for his Iptables Tutorial. -- Best regards, Konstantin Dorichev EPIC Advisors (Russia) Ltd. System Administrator
