Need help reading ipchains packet log.

Need help reading ipchains packet log.

Post by Butter B » Fri, 10 Sep 1999 04:00:00



I have a linux box running Redhat 6.0 with kernel 2.2.11 (with the TCP
patches.) My only network connection is via ppp. The following entries
show up in my ipchains packet log. Anyone know what this means?

  Sep  9 01:24:42 example kernel: registered device ppp0
  Sep  9 01:26:02 example kernel: Packet log: input DENY ppp0 PROTO=17
    xxx.xxx.xxx.xxx:53 yyy.yyy.yyy.yyy:1024 L=198 S=0x00 I=23831 F=0x4000
    T=251 (#10)
  Sep  9 01:26:07 example kernel: Packet log: input DENY ppp0 PROTO=17
    zzz.zzz.zzz.zzz:53 yyy.yyy.yyy.yyy:1024 L=198 S=0x00 I=29465 F=0x4000
    T=251 (#10)

xxx.xxx.xxx.xxx is the IP address of my primary nameserver.
zzz.zzz.zzz.zzz is the IP address of my secondary nameserver.
yyy.yyy.yyy.yyy is my IP (obviously).

Any help would be appreciated.

 
 
 

Need help reading ipchains packet log.

Post by Rob » Sat, 11 Sep 1999 04:00:00


Your nameservers are trying to return the results of a DNS lookup ... you should
be allowing input traffic from your primary and secondary name servers where the
remote port equals 53 (domain) and local port equals any.

Rob


Quote:> I have a linux box running Redhat 6.0 with kernel 2.2.11 (with the TCP
> patches.) My only network connection is via ppp. The following entries
> show up in my ipchains packet log. Anyone know what this means?

>   Sep  9 01:24:42 example kernel: registered device ppp0
>   Sep  9 01:26:02 example kernel: Packet log: input DENY ppp0 PROTO=17
>     xxx.xxx.xxx.xxx:53 yyy.yyy.yyy.yyy:1024 L=198 S=0x00 I=23831 F=0x4000
>     T=251 (#10)
>   Sep  9 01:26:07 example kernel: Packet log: input DENY ppp0 PROTO=17
>     zzz.zzz.zzz.zzz:53 yyy.yyy.yyy.yyy:1024 L=198 S=0x00 I=29465 F=0x4000
>     T=251 (#10)

> xxx.xxx.xxx.xxx is the IP address of my primary nameserver.
> zzz.zzz.zzz.zzz is the IP address of my secondary nameserver.
> yyy.yyy.yyy.yyy is my IP (obviously).

> Any help would be appreciated.