From owner-freebsd-security@FreeBSD.ORG Wed Feb 11 00:49:41 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0437C16A4CE for ; Wed, 11 Feb 2004 00:49:41 -0800 (PST) Received: from nbh-gw.newchem.ru (platan.newchem.ru [81.3.149.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id 57BDB43D31 for ; Wed, 11 Feb 2004 00:49:40 -0800 (PST) (envelope-from illich@newchem.ru) Received: from 127.0.0.1 ([192.168.204.4]) by nbh-gw.newchem.ru (8.12.10/8.12.10) with ESMTP id i1B8ncFg072449 for ; Wed, 11 Feb 2004 11:49:38 +0300 (MSK) (envelope-from illich@newchem.ru) X-AntiVirus: Checked by Dr.Web [version: 4.31, engine: 4.31, virus records: 45906, updated: 10.02.2004] Date: Wed, 11 Feb 2004 11:49:38 +0300 From: Illia Baidakov X-Mailer: The Bat! (v1.62q) Personal X-Priority: 3 (Normal) Message-ID: <1227359974.20040211114938@newchem.ru> To: freebsd-security@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Kernel log output meaning X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Illia Baidakov List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Feb 2004 08:49:41 -0000 Hello security, This output I've received from conventional cron daily job: [...] gw.nbh.ru kernel log messages: > Limiting closed port RST response from 201 to 200 packets per second [...] where fxp0 is an external interface. What could involve such a messages? In /var/log/messages the above strings was prepended by string: Feb 10 13:24:29 gw /kernel: ipfw: limit 100 reached on entry 10800 current ipfw #10800 entry says: 10800 1204 52976 deny log logamount 100 ip from any to 172.16.0.0/12 via fxp0 /var/log/security at this time shows many strings looking like this: Feb 10 13:24:29 gw /kernel: ipfw: 10800 Deny TCP 11.22.33.44:1376 172.29.249.249:7 out via fxp0 11.22.33.44 is my fxp0 iface address. I do not think I have tried to initiate such a connections purposely. Possibly by playing whith spamassassin?.. Remember, I had failed attempt to download its source from its website somewhere at that time. (The second downloading attempt has successed.) -- Thanks in advance, Illia Baidakov.