OT: Deciphering log entry(iptables)

["Scott Taylor" <scottt () soccer com>]

This isn't related to snort (yet) I havn't 
installed it on this network. I was going 
through my log files on this firewall and have a 
ton(literally) of this entry. The only thing 
that changes is the destination ip's last two 
octets. eth0 is the external interface. There is 
no initiating SYN packet out bound.(that I know 
of need to run tcpdump on it for a bit)
Has anyone seen this or know what it may be 
related to?

Mar 31 04:19:35 xxxxfw1 kernel: IN= OUT=eth0 
SRC=aa.bb.cc.ddd(me) DST=aa.bb.ee.ff(them) 
LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF 
PROTO=TCP SPT=80 DPT=2418 WINDOW=0 
RES=0x00 ACK RST URGP=0

Cheers,
  Scott

Oh yea, I think this is good for a drink or 
possibly two.



THERE IS ONLY ONE... 
SOCCER.COM, The Center of the Soccer Universe
http://www.soccer.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users