Re: Firewall log with port 65535 question
Hi!
> > if anyone would spend some time on this "PROTO=2" thing they
> > would realize this is just IGMP .. which means the portnumber
> > has next to NO meaning ..
>
> Oops, didn't notice that.
>
> > that you get this packets means, that your provider is just
> > too stupid to configure his router not to forward such packets
> > to you
>
> But these packets are arriving at eth0, which is his INTERNAL
> network. So these packets are not coming from his DSL
> provider.
Right. Be it TCP, IGMP or any other esoteric protocol, there are packets
being send from the indide to the outside. The come from some forged address
and go to some other addresses. Why should this be considered ok?
Even if they were coming from the ISP - they still would be routed
incorrectly, so they are worth the while to examine them.
Jörn
Reply to: