Re: IP fw-in deny eth0 UDP

["Paul Tod Rieger" <prie@abl.com>]

<erich.schubert@mucl.de> wrote:

>> > Oct  6 23:17:50 www kernel: IP fw-in deny eth0 UDP 127.0.0.1:4412
>> > 255.255.255.255:47624 L=80 S=0x00 I=14054 F=0x0000 T=128
>
>So my conclusion is:
>
>It's a message from a forged ip address (or a seriously
>mißconfigured system) broadcasting to port 47624
>
>Broadcasts should usually be only intra-net.
>Broadcasts from outside ("directed broadcasts") should be
>blocked by your internet router. (to prevent abuse of your
>network for smurf'ing etc.) Check if this broadcast could come
>from outside or if it has to come from inside your network.

eth0 -- shared cable-modem /24 subnet
eth1 -- shared internal 192.168 subnet

So, the packets probably came from one of the other 250+ customers on the
cable-modem subnet -- not from just anywhere on the Internet because those
attempts would have been stopped by the cable's router.

So, one of my "neighbors" is manufacturing packets.  Cute.

Thanks for the info!

Tod
abl.com