About 24 hours ago, I decided to start logging sequence numbers for the
TCP "ct state new" packets that I drop in my initial screening rules.
The result appears quite fascinating... and smells quite fishy: just
about half of these packets have the same (non-zero) sequence number.
The destination ports are mostly 23, trailing off to 22, 2323, and 2222,
which only further adds to the smell.
1) Is anyone else seeing this?
2) Does anyone know what this is?
Thanks.
--
- James
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
