Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have enabled iptables logging for packets coming from the outside

-A INPUT ! -s 192.168.218.0/24 -j LOG

Now i am seeing lots of incoming packets from unknown addresses

Jun  5 14:54:56 localhost kernel: [572504.888953] IN=eth1 OUT= MAC=... SRC=91.189.88.140 DST=192.168.218.101 LEN=1500 TOS=0x00 PREC=0x00 TTL=55 ID=49833 DF PROTO=TCP SPT=80 DPT=47954 WINDOW=295 RES=0x00 ACK URGP=0 
Jun  5 14:54:56 localhost kernel: [572504.916382] IN=eth1 OUT= MAC=... SRC=91.189.88.140 DST=192.168.218.101 LEN=1500 TOS=0x00 PREC=0x00 TTL=55 ID=49834 DF PROTO=TCP SPT=80 DPT=47954 WINDOW=295 RES=0x00 ACK URGP=0 
Jun  5 14:54:56 localhost kernel: [572504.916425] IN=eth1 OUT= MAC=... SRC=91.189.88.140 DST=192.168.218.101 LEN=1000 TOS=0x00 PREC=0x00 TTL=55 ID=49835 DF PROTO=TCP SPT=80 DPT=47954 WINDOW=295 RES=0x00 ACK PSH URGP=0 
Jun  5 14:54:56 localhost kernel: [572505.051902] IN=eth1 OUT= MAC=... SRC=91.189.88.140 DST=192.168.218.101 LEN=1500 TOS=0x00 PREC=0x00 TTL=55 ID=49836 DF PROTO=TCP SPT=80 DPT=47954 WINDOW=295 RES=0x00 ACK URGP=0 
Jun  5 14:54:56 localhost kernel: [572505.184949] IN=eth1 OUT= MAC=... SRC=91.189.88.140 DST=192.168.218.101 LEN=52 TOS=0x00 PREC=0x00 TTL=55 ID=49837 DF PROTO=TCP SPT=80 DPT=47954 WINDOW=295 RES=0x00 ACK FIN URGP=0 
Jun  5 14:55:05 localhost kernel: [572513.916617] IN=eth1 OUT= MAC=... SRC=64.34.119.12 DST=192.168.218.101 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=29430 DF PROTO=TCP SPT=80 DPT=45598 WINDOW=62 RES=0x00 ACK FIN URGP=0 
Jun  5 14:55:14 localhost kernel: [572523.037537] IN=eth1 OUT= MAC=... SRC=64.34.119.12 DST=192.168.218.101 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=80 DPT=45598 WINDOW=62 RES=0x00 ACK URGP=0 
Jun  5 14:55:35 localhost kernel: [572544.026368] IN=eth1 OUT= MAC=... SRC=64.34.119.12 DST=192.168.218.101 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=80 DPT=48218 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
Jun  5 14:55:35 localhost kernel: [572544.149415] IN=eth1 OUT= MAC=... SRC=64.34.119.12 DST=192.168.218.101 LEN=451 TOS=0x00 PREC=0x00 TTL=52 ID=20682 DF PROTO=TCP SPT=80 DPT=48218 WINDOW=63 RES=0x00 ACK PSH URGP=0 
Jun  5 14:55:50 localhost kernel: [572559.133253] IN=eth1 OUT= MAC=... SRC=64.34.119.12 DST=192.168.218.101 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=20683 DF PROTO=TCP SPT=80 DPT=48218 WINDOW=63 RES=0x00 ACK FIN URGP=0 

I've disabled all port forwarding from my router (ssh 22 and openvpn 1194), so I don't understand how these packets are making it to the 192.168.218.101 box (my computer called 'localhost').

I've tried adding tcpdump to investigate these packets with

sudo tcpdump "(dst net 192.168.218.0/24 and ! src net 192.168.218.0/24)"

but it does not return a single line of output.

Any idea why these packets are making it through the router? The router is a home D-Link Dir-600, I've disabled port forwarding and no firewall rules, DMZ disabled.

What sort of diagnostics can I run to know what is the payload in these packets? Why does tcpdump not show anything?

share|improve this question
    
These seem to be incoming packets which are dropped by the firewall. IP tables logging must be done before dropping these packets. I don't see any response to these IPs from your computer –  Julien Jun 5 '11 at 20:25
add comment

1 Answer

up vote 4 down vote accepted

Those are packets that come in as a response to TCP connections initiated by your host - the TCP source port is 80, so they are probably HTTP connections.

The reason being why you don't see them in your tcpdump output is because tcpdump takes the first available interface as the default and would capture packets on eth0, while the packets you see logged by iptables come in at eth1.

share|improve this answer
    
tcpdump -i eth1 <filter> would more than likely show the packets... –  cpbills Jun 5 '11 at 22:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.