3 added 92 characters in body; edited title
source | link

Firewall log entry: neddneed help in interpretation

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds:

/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15 utm ulogd[11342]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth1" outitf="eth0" srcmac="0:20:4d:81:60:5e" dstmac="68:5:ca:2a:12:ba" srcip="192.168.1.28" dstip="144.76.96.172" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="49242" dstport="5222" tcpflags="SYN"

/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15
utm ulogd[11342]:
id="2001"
severity="info"
sys="SecureNet"
sub="packetfilter"
name="Packet dropped"
action="drop"
fwrule="60002"
initf="eth1"
outitf="eth0"
srcmac="0:20:4d:81:60:5e"
dstmac="68:5:ca:2a:12:ba"
srcip="192.168.1.28"
dstip="144.76.96.172"
proto="6"
length="52"
tos="0x00"
prec="0x00"
ttl="127"
srcport="49242"
dstport="5222"
tcpflags="SYN"

What I understand is that host x.x.x.28 is sending a packet to 144.76.96.172 and it gets dropped. That is ok and as designed from the firewalls point of view.

But host .28 should not send anything to this IP address.

How could I identify the application or the process that is sending this packet? Whats tools could I use?

Added more infos as requested in the first comment:

But you've not told us anything about the architecture of the network or the hosts.

  • LAN network 192.168.1.x

  • gateway and DHCP: 192.168.1.1

  • NAT translation to WAN

Have you verified that 192.168.0.0 traffic only comes from your internal network?

The Firewall only has one LAN to watch. It does the DHCP and NAT. It is properly configured. But I do not know how I can verify this.

have you verified that the MAC address is appropriate to the srcip? What OS is running at the srcip?

I verified and it is. Win 7 64bit

Firewall log entry: nedd help in interpretation

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds:

/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15 utm ulogd[11342]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth1" outitf="eth0" srcmac="0:20:4d:81:60:5e" dstmac="68:5:ca:2a:12:ba" srcip="192.168.1.28" dstip="144.76.96.172" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="49242" dstport="5222" tcpflags="SYN"

What I understand is that host x.x.x.28 is sending a packet to 144.76.96.172 and it gets dropped. That is ok and as designed from the firewalls point of view.

But host .28 should not send anything to this IP address.

How could I identify the application or the process that is sending this packet? Whats tools could I use?

Added more infos as requested in the first comment:

But you've not told us anything about the architecture of the network or the hosts.

  • LAN network 192.168.1.x

  • gateway and DHCP: 192.168.1.1

  • NAT translation to WAN

Have you verified that 192.168.0.0 traffic only comes from your internal network?

The Firewall only has one LAN to watch. It does the DHCP and NAT. It is properly configured. But I do not know how I can verify this.

have you verified that the MAC address is appropriate to the srcip? What OS is running at the srcip?

I verified and it is. Win 7 64bit

Firewall log entry: need help in interpretation

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds:

/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15
utm ulogd[11342]:
id="2001"
severity="info"
sys="SecureNet"
sub="packetfilter"
name="Packet dropped"
action="drop"
fwrule="60002"
initf="eth1"
outitf="eth0"
srcmac="0:20:4d:81:60:5e"
dstmac="68:5:ca:2a:12:ba"
srcip="192.168.1.28"
dstip="144.76.96.172"
proto="6"
length="52"
tos="0x00"
prec="0x00"
ttl="127"
srcport="49242"
dstport="5222"
tcpflags="SYN"

What I understand is that host x.x.x.28 is sending a packet to 144.76.96.172 and it gets dropped. That is ok and as designed from the firewalls point of view.

But host .28 should not send anything to this IP address.

How could I identify the application or the process that is sending this packet? Whats tools could I use?

Added more infos as requested in the first comment:

But you've not told us anything about the architecture of the network or the hosts.

  • LAN network 192.168.1.x

  • gateway and DHCP: 192.168.1.1

  • NAT translation to WAN

Have you verified that 192.168.0.0 traffic only comes from your internal network?

The Firewall only has one LAN to watch. It does the DHCP and NAT. It is properly configured. But I do not know how I can verify this.

have you verified that the MAC address is appropriate to the srcip? What OS is running at the srcip?

I verified and it is. Win 7 64bit

2 added 603 characters in body
source | link

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds:

/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15 utm ulogd[11342]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth1" outitf="eth0" srcmac="0:20:4d:81:60:5e" dstmac="68:5:ca:2a:12:ba" srcip="192.168.1.28" dstip="144.76.96.172" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="49242" dstport="5222" tcpflags="SYN"

What I understand is that host x.x.x.28 is sending a packet to 144.76.96.172 and it gets dropped. That is ok and as designed from the firewalls point of view.

But host .28 should not send anything to this IP address.

How could I identify the application or the process that is sending this packet? Whats tools could I use?

Added more infos as requested in the first comment:

But you've not told us anything about the architecture of the network or the hosts.

  • LAN network 192.168.1.x

  • gateway and DHCP: 192.168.1.1

  • NAT translation to WAN

Have you verified that 192.168.0.0 traffic only comes from your internal network?

The Firewall only has one LAN to watch. It does the DHCP and NAT. It is properly configured. But I do not know how I can verify this.

have you verified that the MAC address is appropriate to the srcip? What OS is running at the srcip?

I verified and it is. Win 7 64bit

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds:

/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15 utm ulogd[11342]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth1" outitf="eth0" srcmac="0:20:4d:81:60:5e" dstmac="68:5:ca:2a:12:ba" srcip="192.168.1.28" dstip="144.76.96.172" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="49242" dstport="5222" tcpflags="SYN"

What I understand is that host x.x.x.28 is sending a packet to 144.76.96.172 and it gets dropped. That is ok and as designed from the firewalls point of view.

But host .28 should not send anything to this IP address.

How could I identify the application or the process that is sending this packet? Whats tools could I use?

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds:

/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15 utm ulogd[11342]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth1" outitf="eth0" srcmac="0:20:4d:81:60:5e" dstmac="68:5:ca:2a:12:ba" srcip="192.168.1.28" dstip="144.76.96.172" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="49242" dstport="5222" tcpflags="SYN"

What I understand is that host x.x.x.28 is sending a packet to 144.76.96.172 and it gets dropped. That is ok and as designed from the firewalls point of view.

But host .28 should not send anything to this IP address.

How could I identify the application or the process that is sending this packet? Whats tools could I use?

Added more infos as requested in the first comment:

But you've not told us anything about the architecture of the network or the hosts.

  • LAN network 192.168.1.x

  • gateway and DHCP: 192.168.1.1

  • NAT translation to WAN

Have you verified that 192.168.0.0 traffic only comes from your internal network?

The Firewall only has one LAN to watch. It does the DHCP and NAT. It is properly configured. But I do not know how I can verify this.

have you verified that the MAC address is appropriate to the srcip? What OS is running at the srcip?

I verified and it is. Win 7 64bit

1
source | link

Firewall log entry: nedd help in interpretation

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds:

/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15 utm ulogd[11342]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth1" outitf="eth0" srcmac="0:20:4d:81:60:5e" dstmac="68:5:ca:2a:12:ba" srcip="192.168.1.28" dstip="144.76.96.172" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="49242" dstport="5222" tcpflags="SYN"

What I understand is that host x.x.x.28 is sending a packet to 144.76.96.172 and it gets dropped. That is ok and as designed from the firewalls point of view.

But host .28 should not send anything to this IP address.

How could I identify the application or the process that is sending this packet? Whats tools could I use?