On Mon, 16 Jun 2003 edwarner99@xxxxxxxxx wrote:
> Can someone tell me what this means?
> My system log is full of these.
> Thanks,
>
>
> Jun 16 22:31:06 localhost kernel: DROPPED IN= OUT=eth1
> SRC=192.168.100.1 DST=192.168.100.255 LEN=78 TOS=0x00
^^^^^^^^^^^^^
This machine is the source
> PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1026 DPT=137
^^^
^^^
This is the port it is trying to talk on. It is netbios-ns
which is either a windows machine or samba trying to broadcast netbios
nameserver. and it is being dropped by your iptables.
> LEN=58
> Jun 16 22:31:16 localhost last message repeated 3 times
If this is windows machines on your network I would simply turn off logging to
ports 137 138 and 139 as it is normal windoze chatter. If you do not have
windoze machines on your network then turn off samba on your linux boxes.
You still might want to turn off logging though as there are a LOT of
misconfigured windoze machines broadcasting to these ports on the internet.
It just needlessly fills up the logs.
HTH,
--
......Tom Registered Linux User #14522 http://counter.li.org
tdiehl@xxxxxxxxxxxx My current SpamTrap mtd123@xxxxxxxxxxxx
