Re: ipchains
- To: "syborg" <syborg@box43.pl>, <debian-security@lists.debian.org>
- Subject: Re: ipchains
- From: Christian Jaeger <christian.jaeger@sl.ethz.ch>
- Date: Sun, 1 Jul 2001 15:39:30 +0200
- Message-id: <p04320402b764d815ae0e@[192.168.1.2]>
- In-reply-to: <002901c10189$d5e55b50$265c63d9@dom>
- References: <20010629124757.A4846@doorstop.net><000201c1017a$b0815b70$d15c63d9@dom> <15165.64576.478039.327457@info.unicaen.fr> <002901c10189$d5e55b50$265c63d9@dom>
Some ideas:
Use tcpdump or netstat -i or lsof -i to double check from which IP
the connections are coming. (There are also some entries in /proc/ i
think.)
(We once had a PC with a defective network card or something, and
which sent packages that were inconsistent. So maybe some connections
are going to a different IP. Or maybe your Win2k install binds
multiple IP's to the same Interface.)
Maybe you could try to block the MAC address instead of the IP
address and see if that changes anything.
Use iptables -L to see whether there are other rules which might be
interfering.
Christian.
Reply to: