From owner-freebsd-security@FreeBSD.ORG Mon Apr 14 04:41:30 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 01E9937B401 for ; Mon, 14 Apr 2003 04:41:30 -0700 (PDT) Received: from mx8.mail.ru (mx8.mail.ru [194.67.57.18]) by mx1.FreeBSD.org (Postfix) with ESMTP id F20B943F75 for ; Mon, 14 Apr 2003 04:41:28 -0700 (PDT) (envelope-from h-k@mail.ru) Received: from [194.84.56.194] (port=3596 helo=194.84.56.194) by mx8.mail.ru with esmtp id 1952L1-000OcD-00 for freebsd-security@FreeBSD.ORG; Mon, 14 Apr 2003 15:41:27 +0400 Date: Mon, 14 Apr 2003 15:42:26 +0400 From: dawnshade X-Mailer: The Bat! (v1.62 Christmas Edition) X-Priority: 3 (Normal) Message-ID: <104322900125.20030414154226@mail.ru> To: freebsd-security@FreeBSD.ORG In-Reply-To: <20030414113127.GB3861@blurp.one.pl> References: <20030414113127.GB3861@blurp.one.pl> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: strange connection attempts X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: dawnshade List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Apr 2003 11:41:30 -0000 G> I have turned on sysctls variables: G> net.inet.tcp.log_in_vain: 1 G> net.inet.udp.log_in_vain: 1 G> And i have plenty of strange connection attempts on udp protocol G> Connection attempt to UDP xx.xx.x.xxx:55414 from 192.43.172.34:53 G> Apr 13 23:56:53 pals /kernel: Connection attempt to UDP xx.xx.x.xxx:55414 from 192.43.172.34:53 G> Connection attempt to UDP xx.xx.x.xxx:12545 from 192.42.93.36:53 G> Apr 13 23:56:54 pals /kernel: Connection attempt to UDP xx.xx..xxx:12545 from 192.42.93.36:53 G> Connection attempt to UDP xx.xx.x.xxx:44308 from 192.42.93.36:53 G> i know that those connections are from dns but why kernel logs such thing. G> I have statufull firewall and all trafic to any port on UDP protocol are deny and G> only those UDP datagrams from my resolver are passed back through dynamics rules. G> These connections are caused by returned queruies from dns servers. G> Is it normal to have such type connection attempts ? G> Can anybody help me solve my problem. I think yes. Got a same messages. The suspicion on squid - when connect to some server not completed or refused. ---------- root@some_hostname.ru$ echo "reboot" > /etc/rc&&reboot ---------- Best regards, dawnshade mailto:h-k@mail.ru