> My firewall has been getting two or three hits per day that have the
> source port set to 3, and the destination port set to 1. I can see
> port 1 in /etc/services, but I don't see port 3 listed anywhere. Any
> ideas as to what this is?
> The source IP address never resolves to anything, so I haven't bothered
> to copy them over to this box. The SYN flag is never set. The packets
> come in at either 12 or 24 second intervals.
These are icmp packets (not TCP, so SYN's are never set). icmp type 3 is
"destination unreachable", normally you can (must) receive it trying to
If your firewall handles icmp types correctly (so if you really can
'traceroute'), than it may be some kind of "brute" behavior.
Read more about ports and attacs at
Dmytro O. Redchuk,
PopNet Kommunikation Kiew,
Fax : (380).184.108.40.206