Re: Firewall log with port 65535 question
Anyway it is a network-multicast-address ..
this could be any shareware-program for Window$
(babylon, Norton Ghost for example)
sending some nice cookies to a server :))
you could fetch them with tcpdump -w <filename> proto igmp
or something like that ..
i could be a problem with routing on your box too ..
but i would go for the first possibility ..
MFG
christian bahls
On Wed, 1 Nov 2000, Michael Wood wrote:
> On Wed, Nov 01, 2000 at 01:54:05PM +0100, Christian Ruediger Bahls wrote:
> > On Tue, 31 Oct 2000, Bill Bell wrote:
> >
> > if anyone would spend some time on this "PROTO=2" thing they
> > would realize this is just IGMP .. which means the portnumber
> > has next to NO meaning ..
>
> Oops, didn't notice that.
>
> > that you get this packets means, that your provider is just
> > too stupid to configure his router not to forward such packets
> > to you
>
> But these packets are arriving at eth0, which is his INTERNAL
> network. So these packets are not coming from his DSL
> provider.
>
> --
> Michael Wood | Tel: +27 21 762 0276 | http://www.kingsley.co.za/
> wood@kingsley.co.za | Fax: +27 21 761 9930 | Kingsley Technologies
>
Reply to: