[prev in list] [next in list] [prev in thread] [next in thread] 

List:       suse-linux-e
Subject:    Re: [SLE] Firewall Log Interpretation Requested
From:       "L. Mark Stone" <LMStone () LMStone ! com>
Date:       2003-02-14 6:32:15
[Download RAW message or body]

On Tue, 2003-02-11 at 23:59, Joe Morris (NTM) wrote:
> On 02/12/2003 11:10 AM, L. Mark Stone wrote:
> 
> >FYI the Linux box is connected to a D-Link DI-704P DSL router performing
> >DHCP. The D-Link device always assigns the IP address of 192.168.0.247
> >to the Linux box.
> >
> >Feb 11 21:58:52 bronxville kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth0
> >OUT= MAC= SRC=192.168.0.247 DST=192.168.0.255 LEN=96 TOS=0x00 PREC=0x00
> >TTL=64 ID=5 DF PROTO=UDP SPT=137 DPT=137 LEN=76
> >  
> >
> source is your linux box, 192.168.0.247
> destination is a broadcast, 192.168.0.255
> protocol is udp
> source port is 137
> destination port is 137
> conclusion, a netbios name server broadcast packet.  I would conclude 
> you are running samba, which is trying to register with the netbios name 
> server of a Windows network.  HTH
> 
> -- 
> Joe Morris
> New Tribes Mission
> Email Address: Joe_Morris@ntm.org
> Web Address: http://www.mydestiny.net/~joe_morris
> Registered Linux user 231871
> God said, I AM that I AM.  I say, by the grace of
> God, I am what I am.

That was it; thanks!

-- 
___________________________________________________________________
A Message From...  L. Mark Stone
http://www.lmstone.com




-- 
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-help@suse.com
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-faq@suse.com


[prev in list] [next in list] [prev in thread] [next in thread]