What does this mean?
Hi
I see this in my firewall log:
Feb 27 16:51:19 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.67 DST=68.84.228.144 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=64368 DF PROTO=TCP SPT=54767 DPT=0 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
What is DPT=0? I've never heard of using port 0 ...
What is CWR ECE SYN? Are they TCP flags? If so, what is CWR ECE ?
Ray
Quoted 7 lines
I see this in my firewall log:
Feb 27 16:51:19 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0SRC=10.0.0.67 DST=68.84.228.144 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=64368 DF PROTO=TCP SPT=54767 DPT=0 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0
What is DPT=0? I've never heard of using port 0 ...
No services there, this packet is certainly invalid. Some OS's respond to them with tcp rst, some just drop them.
Quoted 1 line
What is CWR ECE SYN? Are they TCP flags? If so, what is CWR ECE ?
Yes they are TCP flags, CWR & ECE are ECN extensions to the TCP header. Read RFC 3168.
Note, some routers outthere are not ECN aware and violate RFC 3168 by dropping these packets. This causes interoperability problems, which should be resolved by vendors.
Quoted 1 line
Ray
Maciej
Quoted 3 lines · Maciej Soltysiak
Note, some routers outthere are not ECN aware and violate RFC 3168 by dropping these packets. This causes interoperability problems, which should be resolved by vendors.
At http://urchin.earth.li/cgi-bin/ecn.pl?output=ip is a list with routers with are known to violate ECN. There is even a perl-script around wich uses the --remove-ecn feature of the ECN target to create rules based on that list of IP-addresses. Quite nice, since it sorts out the problem locally - but not in a global sense. Call it self-defense.
Quoted 2 lines
Quoted 1 line
Ray
Maciej
Alex
Signature · 2 lines
"Mr Data, when I said 'Fire at Will', I didn't mean for you to be so literal." Instructions for use of this post: Insert tounge in cheek. Read as normal.