I'm hoping someone can help me interpret some log entries that show up in my logs a couple of times a day. These systems are on an internal network and are not directly connected to the Internet. The rules that generate the log entries are: iptables -A INPUT -i $EXT_INTERFACE -m state --state INVALID -m limit -j LOG --log-prefix "Invalid: " --log-level 6 iptables -A INPUT -i $EXT_INTERFACE -m state --state INVALID -j DROP The log entries are something like this (the Internet IP changes): Apr 28 22:45:00 hostname kernel: Invalid: IN=eth0 OUT= MAC=XX:XX . . SRC=Internet_IP DST=192.168.100.100 LEN=76 TOS=0x00 PREC=0x20 TTL=53 ID=15756 PROTO=ICMP TYPE=3 CODE=2 [SRC=192.168.100.100 DST=Internet_IP LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=766 DF PROTO=32 ] I'm not sure what it is telling me. These systems are internal servers and shouln't have any reason to contact the Internet except maybe for patching. Is this trying to tell me that my system (192.168.100.100) tried to talk to Internet_IP and got back a ICMP protocal unreachable. This doesn't seem likely given what they are used for. The square bracket info has me confused especially with PROTO=32. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
