Traffic from [127.0.0.1]

This is a discussion on Traffic from [127.0.0.1] within the IPFilter forums, part of the System Security and Security Related category; To anyone who can assist: I have captured incoming traffic that looks like the following: tcpdump: listening on fxp0 16:...


Go Back   Usenet Forums > System Security and Security Related > IPFilter

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 04-30-2004
Matthew K. Lee
 
Posts: n/a
Default Traffic from [127.0.0.1]

To anyone who can assist:

I have captured incoming traffic that looks like the following:

tcpdump: listening on fxp0
16:14:28.739422 127.0.0.1.80 > xxx.xx.xx.6.1463: R [tcp sum ok] 0:0(0)
ack 73334785 win 0 (ttl 125, id 23431, len 40)
16:14:33.619279 127.0.0.1.80 > xxx.xx.xx.2.1192: R [tcp sum ok] 0:0(0)
ack 864092161 win 0 (ttl 123, id 59192, len 40)
16:15:07.119504 127.0.0.1.80 > xxx.xx.xx.2.1952: R [tcp sum ok] 0:0(0)
ack 843317249 win 0 (ttl 123, id 61397, len 40)
16:15:58.308952 127.0.0.1.80 > xxx.xx.xx.6.1488: R [tcp sum ok] 0:0(0)
ack 1767636993 win 0 (ttl 123, id 64714, len 40)
16:16:15.059209 127.0.0.1.80 > xxx.xx.xx.6.1752: R [tcp sum ok] 0:0(0)
ack 683540481 win 0 (ttl 123, id 254, len 40)
16:16:17.161879 127.0.0.1.80 > xxx.xx.xx.6.1701: R [tcp sum ok] 0:0(0)
ack 250478593 win 0 (ttl 123, id 42020, len 40)

The dest port changes, but the source stays the same. This is the way
that my rule set begins:

#-------------------------------------------------
#This section prevents spoofing and smurf attacks.
#-------------------------------------------------
block in quick on fxp0 from 192.168.0.0/16 to any
block in quick on fxp0 from 172.16.0.0/12 to any
block in quick on fxp0 from 127.0.0.0/8 to any
block in quick on fxp0 from 10.0.0.0/8 to any
....

1. Does anyone know the source of this traffic?
2. I'm not getting any blocked packets in my log. Am I doing something
wrong?

Thanks,

Matthew Lee
Rycan Technologies, Inc.
http://www.rycan.com
mattl@rycan.com


Reply With Quote
Reply
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 09:45 PM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0