From owner-freebsd-security Wed Feb 7 7:16:47 2001 Delivered-To: freebsd-security@freebsd.org Received: from mail.sageian.com (ns.sage-consult.com [208.201.118.11]) by hub.freebsd.org (Postfix) with ESMTP id 6095A37B401 for ; Wed, 7 Feb 2001 07:16:29 -0800 (PST) Received: from pricli012 (proxy.sageian.com [208.201.118.126]) by mail.sageian.com (Postfix) with SMTP id A3D136A904 for ; Wed, 7 Feb 2001 10:16:26 -0500 (EST) Message-ID: <00bd01c09119$0aff5750$4c00000a@sage> Reply-To: "Rossen Raykov" From: "Rossen Raykov" To: References: <00a101c09116$49dca980$4c00000a@sage> <20010207165845.P487@ringworld.oblivion.bg> Subject: Re: ipfw question Date: Wed, 7 Feb 2001 10:17:11 -0500 Organization: SageConsult, Princeton MIME-Version: 1.0 Content-Type: text/plain; charset="windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Looks like I can not count zeros :( (I'm going for a cup of coffee...) Thanks! ----- Original Message ----- From: To: Cc: Sent: Wednesday, February 07, 2001 9:58 AM Subject: Re: ipfw question > On Wed, Feb 07, 2001 at 09:57:27AM -0500, Rossen Raykov wrote: > > Hi All, > > > > I have the following lines in my firewall config file (fragment from ipfw > > show): > > > > 03010 108 10919 allow udp from local.ip to any > > 50000 0 0 allow udp from any 40000-50000 to local.ip 40000-50000 > > 50001 21 1694 allow log logamount 1024 udp from any to any > > > > And I have the following records in security log: > > > > Feb 7 08:49:33 myhost /kernel: ipfw: 50001 Accept UDP forien.ip.1:4000 > > local.ip:49160 in via dc0 > > Feb 7 08:49:42 myhost last message repeated 10 times > > Feb 7 08:52:10 myhost last message repeated 2 times > > Feb 7 09:00:34 myhost last message repeated 7 times > > Feb 7 09:02:34 myhost /kernel: ipfw: 50001 Accept UDP forien.ip.2:4000 > > local.ip:49160 in via dc0 > > > > My question is why those packets ware not captured from rule 50000 but from > > 50001? > > Are you sure you've listed your firewall rules right? Rule 50000 > wants the incoming packet to be between 40,000 and 50,000, and > a source port of 4,000 is definitely less than 40,000 :) > > G'luck, > Peter > > -- > This inert sentence is my body, but my soul is alive, dancing in the sparks of your brain. > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message