Puzzling firewall log entries - addressed to local IP address

  • Thread starter Thread starter BeamGuy
  • Start date Start date
B

BeamGuy

Please forgive me if I seem a little green, but I am wondering if someone can explain
these entries in my firewall log from a linksys router. The first two and last two entries
are normal, the middle two have me scratching my head. I seem to be getting these
pairs of events at the same time, one Invalid TCP packet and on incoming probe
addressed not at my external IP address but at my internal NAT address. Is there
a standard explanation for this?

Thanks

2004/04/21 22:39:56.59 I tcp 68.163.151.221 4735 68.163.135.42 1025
2004/04/21 22:43:02.48 I tcp 68.162.90.222 4682 68.163.135.42 445

2004/04/21 22:47:22.52 I tcp 64.236.24.12 80 192.168.1.100 3005
2004/04/21 22:47:22.52 M Invalid TCP packet received, dropping packet

2004/04/21 22:54:32.75 I tcp 68.163.183.5 3935 68.163.135.42 445
2004/04/21 22:54:33.61 I udp 218.108.171.38 64517 68.163.135.42 137
 
64.236.24.12 is the site address for cnn.com [I put it in my IE address bar]
however it makes no sense why the return address is a private non routable
address [assuming this is not through an ipsec tunnel] and that is why the
router dropped it, hence the invalid packet message with the same timestamp.
If it is an attack attempt, it is a pretty poor one. You might want to post
on one of the firewall newsgroups also such as comp.security.firewalls - a
very active newsgroup. --- Steve
 
Back
Top