This is a discussion on Traffic from [127.0.0.1] within the IPFilter forums, part of the System Security and Security Related category; To anyone who can assist: I have captured incoming traffic that looks like the following: tcpdump: listening on fxp0 16:...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
To anyone who can assist:
I have captured incoming traffic that looks like the following: tcpdump: listening on fxp0 16:14:28.739422 127.0.0.1.80 > xxx.xx.xx.6.1463: R [tcp sum ok] 0:0(0) ack 73334785 win 0 (ttl 125, id 23431, len 40) 16:14:33.619279 127.0.0.1.80 > xxx.xx.xx.2.1192: R [tcp sum ok] 0:0(0) ack 864092161 win 0 (ttl 123, id 59192, len 40) 16:15:07.119504 127.0.0.1.80 > xxx.xx.xx.2.1952: R [tcp sum ok] 0:0(0) ack 843317249 win 0 (ttl 123, id 61397, len 40) 16:15:58.308952 127.0.0.1.80 > xxx.xx.xx.6.1488: R [tcp sum ok] 0:0(0) ack 1767636993 win 0 (ttl 123, id 64714, len 40) 16:16:15.059209 127.0.0.1.80 > xxx.xx.xx.6.1752: R [tcp sum ok] 0:0(0) ack 683540481 win 0 (ttl 123, id 254, len 40) 16:16:17.161879 127.0.0.1.80 > xxx.xx.xx.6.1701: R [tcp sum ok] 0:0(0) ack 250478593 win 0 (ttl 123, id 42020, len 40) The dest port changes, but the source stays the same. This is the way that my rule set begins: #------------------------------------------------- #This section prevents spoofing and smurf attacks. #------------------------------------------------- block in quick on fxp0 from 192.168.0.0/16 to any block in quick on fxp0 from 172.16.0.0/12 to any block in quick on fxp0 from 127.0.0.0/8 to any block in quick on fxp0 from 10.0.0.0/8 to any .... 1. Does anyone know the source of this traffic? 2. I'm not getting any blocked packets in my log. Am I doing something wrong? Thanks, Matthew Lee Rycan Technologies, Inc. http://www.rycan.com mattl@rycan.com |