View Single Post

  #1 (permalink)  
Old 05-01-2008
Greg Russell
 
Posts: n/a
Default --state NEW for UDP?

I am trying to log all instances of --state NEW packets on our interface
to the Internet, and am occasionally getting some UDP packets that match
the logging criteria from DNS nameservers:

Resolved_Address Packets Bytes Protocol(s) Dest.Port
148.78.249.202.starband.com 1 190 UDP 45236
ns1.eburg.com 1 256 UDP 45241
ns1-mar.starband.com 1 124 UDP 45271

Is there any reason why a nameserver in /etc/resolv.conf would be sending
me unsolicited UDP packets? The iptables rule that causes the logging is:

-A INPUT -m state -i eth1 --state NEW -j LOG --log-level 7 \
--log-prefix UNSOLICITED:

and the logged entry for the first instance above is:

May 1 08:31:48 centos51 kernel: UNSOLICITED:IN=eth1 OUT=
MAC=00:03:6d:17:df:1a:00:a0:ad:09:1d:88:08:00 SRC=148.78.249.202
DST=148.78.x.y LEN=105 TOS=0x00 PREC=0x00 TTL=60 ID=0 DF PROTO=UDP SPT=53
DPT=45236 LEN=85
Reply With Quote