leadbelly
09-03-2006, 10:19
So, i edited the post-firewall and inserted new code as mentioned at macsat-forum (link) (http://www.macsat.com/macsat/component/option,com_smf/Itemid,31/topic,206.0)
and after that iv'e seen a strange post in my syslog...
Mar 9 11:03:37 kernel: SSH ACCEPT IN=vlan1 OUT= MAC=00:15:f2:0a:a9:bf:00:12:da:29:6c:8c:08:00:45:0 0:00:30 SRC=212.214.85.74 DST=192.168.1.1 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=53262 DF PROTO=TCP SPT=31175 DPT=22 SEQ=3181412581 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B401010402)
This is repeated with different ipadresses every now and then...
Why i believe it to be strange is the "SSH ACCEPT" part...
What is accepted, and why?
:confused:
(I knoow there is info in this that is promiskous for my part, but it doesn'r matter that much :) )
and after that iv'e seen a strange post in my syslog...
Mar 9 11:03:37 kernel: SSH ACCEPT IN=vlan1 OUT= MAC=00:15:f2:0a:a9:bf:00:12:da:29:6c:8c:08:00:45:0 0:00:30 SRC=212.214.85.74 DST=192.168.1.1 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=53262 DF PROTO=TCP SPT=31175 DPT=22 SEQ=3181412581 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B401010402)
This is repeated with different ipadresses every now and then...
Why i believe it to be strange is the "SSH ACCEPT" part...
What is accepted, and why?
:confused:
(I knoow there is info in this that is promiskous for my part, but it doesn'r matter that much :) )