Le mar 23/12/2003 à 14:37, Vinayakam Murugan a écrit : > We were not able to reproduce it out here.Anyways in this scenario, would > the packet would have the state as NEW? All these logs are of packets with > state NEW. These packets are delayed ones, probably due to high latency (heavy load on line ?). Most of the time, there's not much to worry about, especially on DSL line when upload goes up. > Another peculiar log which we would like to get more info on are > Dec 23 18:43:05 theargonserver kernel: IPT IN_FIREWALL_NEW: IN=eth1 OUT= > MAC=00:03:47:6a:5c:6b:00:c0:49:25:d1:a3:08:00 SRC=80.15.238.66 > DST=xxx.xxx.xxx.xxx LEN=73 TOS=0x00 PREC=0x00 TTL=55 ID=0 DF PROTO=UDP > SPT=31819 DPT=53 LEN=53 > There are a lot of packets to port 53. Is this normal? Seems that someone wants to ask some DNS stuff to your box :) Maybe this IP is declared somewhere as authoritative for a domain or someone use it as forwarder. -- http://www.netexit.com/~sid/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE >> Hi! I'm your friendly neighbourhood signature virus. >> Copy me to your signature file and help me spread!
