From owner-freebsd-questions@FreeBSD.ORG  Mon Sep 15 14:41:37 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id ED3CC16A4BF
	for <freebsd-questions@freebsd.org>;
	Mon, 15 Sep 2003 14:41:37 -0700 (PDT)
Received: from smtp2.fre.skanova.net (smtp2.fre.skanova.net [195.67.227.95])
	by mx1.FreeBSD.org (Postfix) with ESMTP id E371C43FDD
	for <freebsd-questions@freebsd.org>;
	Mon, 15 Sep 2003 14:41:35 -0700 (PDT)
	(envelope-from webmaster@swedehost.com)
Received: from thor.swedehost.com (h129n2fls33o804.telia.com
	[217.209.211.129])h8FLfRDo014194;
	Mon, 15 Sep 2003 23:41:27 +0200 (CEST)
From: Hasse Hansson <webmaster@swedehost.com>
Organization: The Valhalla Project
To: Roman Neuhauser <neuhauser@bellavista.cz>
Date: Mon, 15 Sep 2003 23:41:26 +0200
User-Agent: KMail/1.5.3
References: <200309120537.17416.webmaster@swedehost.com>
	<200309151217.02016.webmaster@swedehost.com>
	<20030915120212.GC2511@freepuppy.bellavista.cz>
In-Reply-To: <20030915120212.GC2511@freepuppy.bellavista.cz>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200309152341.26609.webmaster@swedehost.com>
cc: FreeBSD Questions <freebsd-questions@freebsd.org>
Subject: Re: Need help to interp kernel log message.
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Sep 2003 21:41:38 -0000

On Monday 15 September 2003 14.02, Roman Neuhauser wrote:
> # webmaster@swedehost.com / 2003-09-15 12:17:01 +0200:
> > On Saturday 13 September 2003 03.24, Roman Neuhauser wrote:
> > > # webmaster@swedehost.com / 2003-09-12 05:37:17 +0200:
> > > > I 've got a message in my logfiles that I don't understand.
> > > > The ip-addresses are none that I'm to my knowing are associated
> > > > with. Wonder what it is or if it's anything to worry about.
> > > >
> > > > odin.swedehost.com kernel log messages:
> > > > > icmp redirect from 65.104.98.146: 204.152.184.189 =>
> > > > > 65.104.98.145
> > > >
> > > > Checking up on the above Ip-addresses don't ring any bells
> > > > ider.
> > >
> > >     Looks like your machine was sending traffic to
> > > 204.152.184.189, and an intermediate host at 65.104.98.146 sent
> > > an ICMP redirect message telling it to send them to 65.104.98.145
> > > instead. See RFC 792.
> > >
> > >     As for security concerns: any packet might have the source
> > > address spoofed, and obeying ICMP type 5 messages in a hostile
> > > environment (like the internet) means you're giving your network
> > > traffic out for public consumption.
> >
> > Thx for your answer.
> > In my rc.conf file, I do have
> > icmp_drop_redirect="YES"
> > icmp_log_redirect="YES"
> > but I guess that's not enough.
> > Probably have to block in my firewall.
>
>     what makes you think so? did the box really change the route?

Ahhh....
You mean it dropped and logged it. Just as supposed to ?