RE: Unusual incoming traffic detected from klecker.debian.org and sou rce.rfc822.org
-----Message d'origine-----
De : Norbert Tretkowski [mailto:norbert@tretkowski.de]
Envoyé : mercredi 14 septembre 2005 12:58
>* Mathieu JANIN wrote:
>> I detected some unexpected incoming traffic from klecker.debian.org
>> (ports TCP 4672, 4668), and source.rfc822.org (port TCP 1794), all
>> coming from port 80 at 12:17 yesterday.
>> I was updating my system at that time, but klecker.debian.org is not
>> in my sources (or perharps with an other name).
>klecker.debian.org is security.debian.org,
>source.rfc822.org is ftp2.de.debian.org.
Yes, but now that I know that (they are both in my sources.list, indeed), I
wonder why, for the first time, I got incoming packets (logged in input
filter), that are targeting a PRIVATE iface (10.x.y.1) behind both an
Alcatel speedtouch home modem and a Netopia box...
And those packets were not accepted by a previous accept rule for
ESTABLISHED/RELATED.
???
>Norbert
MATT
Reply to: