From owner-freebsd-security@FreeBSD.ORG Mon Apr 14 13:03:30 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E202337B401 for ; Mon, 14 Apr 2003 13:03:30 -0700 (PDT) Received: from rwcrmhc52.attbi.com (rwcrmhc52.attbi.com [216.148.227.88]) by mx1.FreeBSD.org (Postfix) with ESMTP id 52F6343FBD for ; Mon, 14 Apr 2003 13:03:30 -0700 (PDT) (envelope-from crist.clark@attbi.com) Received: from blossom.cjclark.org (12-234-159-107.client.attbi.com[12.234.159.107]) by rwcrmhc52.attbi.com (rwcrmhc52) with ESMTP id <2003041420032905200litite>; Mon, 14 Apr 2003 20:03:29 +0000 Received: from blossom.cjclark.org (localhost. [127.0.0.1]) by blossom.cjclark.org (8.12.8p1/8.12.3) with ESMTP id h3EK3Tki022192; Mon, 14 Apr 2003 13:03:29 -0700 (PDT) (envelope-from crist.clark@attbi.com) Received: (from cjc@localhost) by blossom.cjclark.org (8.12.8p1/8.12.8/Submit) id h3EK3P8q022191; Mon, 14 Apr 2003 13:03:25 -0700 (PDT) X-Authentication-Warning: blossom.cjclark.org: cjc set sender to crist.clark@attbi.com using -f Date: Mon, 14 Apr 2003 13:03:25 -0700 From: "Crist J. Clark" To: GiZmen Message-ID: <20030414200325.GB21249@blossom.cjclark.org> References: <20030414113127.GB3861@blurp.one.pl> <20030414151520.GD33167@kurdistan.ath.cx> <20030414194431.GA48589@blurp.one.pl> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030414194431.GA48589@blurp.one.pl> User-Agent: Mutt/1.4.1i X-URL: http://people.freebsd.org/~cjc/ cc: freebsd-security@FreeBSD.ORG Subject: Re: strange connection attempts X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Crist J. Clark" List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Apr 2003 20:03:31 -0000 On Mon, Apr 14, 2003 at 09:44:31PM +0200, GiZmen wrote: [snip] > my address is "xxx" and 192.43..... is an expamle address of dns server. > > I know that dns use an udp protocol but is it normal to have these connection > attempts?? Someone else already explained this. It comes down to: the timeout of your DNS application is shorter than the timeout on the firewall. Your DNS application sends out a query and waits... and gives up. When it give up, it closes the socket. However, the DNS server Out There manages to still return a response some time later. Your firewall has not timed out the UDP "connection" yet, so the response come through. But there is no listening socket anymore, so it gets logged_in_vain. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org