What process sent packets dropped by firewall?

cherylchase · 03-11-2005, 11:49 AM

I am running RHEL 3, with APF firewall on a dedicated server. This is a web server in a data center, so I have most things tightened up. No one is allowed to login to the machine but me (ssh). I have users who use http, https, pops, smtp, imap.

APF is dropping outgoing packets like these, and I would like to figure out how/why/by whom they are being sent. How can I get back from these /var/log/messages to the process?

Code:

Mar 11 07:26:28 roseland kernel: ** OUT_TCP DROP ** IN= OUT=eth0 SRC=67.18.50.202
DST=80.116.190.98 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=63778 DF PROTO=TCP SPT=80 
DPT=2038 WINDOW=5840 RES=0x00 ACK FIN URGP=0 

Mar 11 02:00:07 roseland kernel: ** OUT_UDP DROP ** IN= OUT=eth0 SRC=67.18.50.202 
DST=67.18.50.201 LEN=76 TOS=0x00 PREC=0x00 TTL=64 ID=7 DF PROTO=UDP SPT=43196 
DPT=123 LEN=56 


Mar 11 08:40:10 roseland kernel: ** OUT_TCP DROP ** IN= OUT=eth0 SRC=67.18.50.202 
DST=213.217.51.3 LEN=1500 TOS=0x00 PREC=0x00 TTL=64 ID=42317 DF PROTO=TCP SPT=80 
DPT=62186 WINDOW=6432 RES=0x00 ACK URGP=0

Mara · 03-12-2005, 05:44 PM

It looks they're sent by one machine. Is it the server one or another? SPT=80 means Apache probably (if it's using port 80). DPT=123 means time protocol. Maybe you're running a service that's trying to get time, but you block it?

mcd · 03-17-2005, 06:04 PM

maybe netstat -anp would help?

this213 · 03-18-2005, 05:36 AM

There are 2 things going on here.

First, your firewall is dumping ACK and ACK FIN packets which your web server is sending out as part of the tcp/ip handshake. Look here:
http://www.vs.inf.ethz.ch/edu/WS0102...e-Diagram.html

The other entry is an ntp client on 67.18.50.202 trying to talk to ntp server on 67.18.50.201, you should probably add a rule to your firewall that allows this, or reconfigure your ntp client. I'm speaking of this rule:

Code:

Mar 11 02:00:07 roseland kernel: ** OUT_UDP DROP ** IN= OUT=eth0 SRC=67.18.50.202 
DST=67.18.50.201 LEN=76 TOS=0x00 PREC=0x00 TTL=64 ID=7 DF PROTO=UDP SPT=43196 
DPT=123 LEN=56

TruckStuff · 03-18-2005, 09:36 AM

Quote:

Originally posted by this213
First, your firewall is dumping ACK and ACK FIN packets which your web server is sending out as part of the tcp/ip handshake. Look here:
http://www.vs.inf.ethz.ch/edu/WS0102...e-Diagram.html

So why doesn't iptables pick these packets up as established or related to the new connection?