On my CentOS box that I use mainly as a web server, I have iptables set to log and reject anything that I don't expect. So lately, I have getting things like this:
Mar 29 17:27:20 mbrc20 kernel: IPT-DROP IN= OUT=lo SRC=192.168.9.20 DST=192.168.9.20 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=46910 DF PROTO=TCP SPT=56624 DPT=80 WINDOW=32792 RES=0x00 SYN URGP=0 OPT (0204400C0402080A4A26F7A50000000001030307) UID=0
that on at least one occasion repeated for every few seconds for more than three hours. The ephemeral source port keeps changing in an irregular manner.
Any suggestions?
Thanks, Mike
Michael D. Berger wrote:
On my CentOS box that I use mainly as a web server, I have iptables set to log and reject anything that I don't expect. So lately, I have getting things like this:
Mar 29 17:27:20 mbrc20 kernel: IPT-DROP IN= OUT=lo SRC=192.168.9.20 DST=192.168.9.20 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=46910 DF PROTO=TCP SPT=56624 DPT=80 WINDOW=32792 RES=0x00 SYN URGP=0 OPT (0204400C0402080A4A26F7A50000000001030307) UID=0
that on at least one occasion repeated for every few seconds for more than three hours. The ephemeral source port keeps changing in an irregular manner.
<snip> Not great on this, but *if* I understand it, it's saying that the IP address of your server is 192.168.9.20, and it's talking to itself, at destination port 80 - apache, that would be.
mark
On Fri, 01 Apr 2011 11:32:16 -0400, m.roth-x6lchVBUigD1P9xLtpHBDw wrote:
Michael D. Berger wrote:
[...]
<snip> Not great on this, but *if* I understand it, it's saying that the IP address of your server is 192.168.9.20, and it's talking to itself, at destination port 80 - apache, that would be.
mark
Yes, that is true, but the question is "who is doing the talking?". Another block of them just ended. It lasted just under an hour.
Mike.
Michael D. Berger wrote:
On Fri, 01 Apr 2011 11:32:16 -0400, m.roth-x6lchVBUigD1P9xLtpHBDw wrote:
Michael D. Berger wrote:
[...]
<snip> Not great on this, but *if* I understand it, it's saying that the IP address of your server is 192.168.9.20, and it's talking to itself, at destination port 80 - apache, that would be.
markYes, that is true, but the question is "who is doing the talking?". Another block of them just ended. It lasted just under an hour.
you might be able to see the process with netstat when it's happening.
well, first question: why don't you allow local access to port 80? There is no reason for that. This is httpd itself. Switch on the status page and then look for yourself. It's a well-known "phenomenon" since Apache 2.0 or 2.2.
Kai
On 1.4.2011 17:20, Michael D. Berger wrote:
On my CentOS box that I use mainly as a web server, I have iptables set to log and reject anything that I don't expect. So lately, I have getting things like this:
Mar 29 17:27:20 mbrc20 kernel: IPT-DROP IN= OUT=lo SRC=192.168.9.20 DST=192.168.9.20 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=46910 DF PROTO=TCP SPT=56624 DPT=80 WINDOW=32792 RES=0x00 SYN URGP=0 OPT (0204400C0402080A4A26F7A50000000001030307) UID=0
that on at least one occasion repeated for every few seconds for more than three hours. The ephemeral source port keeps changing in an irregular manner.
Any suggestions?
Too restrictive OUT=lo This is the loopback device! Add a rule that allows traffic from and to lo
On Fri, 01 Apr 2011 22:10:58 +0200, Markus Falb wrote:
[...]
Mar 29 17:27:20 mbrc20 kernel: IPT-DROP IN= OUT=lo SRC=192.168.9.20 DST=192.168.9.20 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=46910 DF PROTO=TCP SPT=56624 DPT=80 WINDOW=32792 RES=0x00 SYN URGP=0 OPT (0204400C0402080A4A26F7A50000000001030307) UID=0
[...]
Too restrictive OUT=lo This is the loopback device! Add a rule that allows traffic from and to lo
What sort of thing might be using it? It only shows up every day or two.
Mike.
-
Kai Schaetzl -
m.roth＠5-cent.us -
Markus Falb -
Michael D. Berger -
Nicolas Thierry-Mieg