# Firewall log entry: need help in interpretation

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds:

/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15
utm ulogd[11342]:
id="2001"
severity="info"
sys="SecureNet"
sub="packetfilter"
name="Packet dropped"
action="drop"
fwrule="60002"
initf="eth1"
outitf="eth0"
srcmac="0:20:4d:81:60:5e"
dstmac="68:5:ca:2a:12:ba"
srcip="192.168.1.28"
dstip="144.76.96.172"
proto="6"
length="52"
tos="0x00"
prec="0x00"
ttl="127"
srcport="49242"
dstport="5222"
tcpflags="SYN"


What I understand is that host x.x.x.28 is sending a packet to 144.76.96.172 and it gets dropped. That is ok and as designed from the firewalls point of view.

But host .28 should not send anything to this IP address.

How could I identify the application or the process that is sending this packet? Whats tools could I use?

But you've not told us anything about the architecture of the network or the hosts.

• LAN network 192.168.1.x

• gateway and DHCP: 192.168.1.1

• NAT translation to WAN

Have you verified that 192.168.0.0 traffic only comes from your internal network?

The Firewall only has one LAN to watch. It does the DHCP and NAT. It is properly configured. But I do not know how I can verify this.

have you verified that the MAC address is appropriate to the srcip? What OS is running at the srcip?

I verified and it is. Win 7 64bit

• From the way you have presented your question you may still have a long journey ahead of you. The information you've provided suggest that it may be a jabber client. But you've not told us anything about the architecture of the network or the hosts. Have you verified that 192.168.0.0 traffic only comes from your internal network? have you verified that the MAC address is appropriate to the srcip? What OS is running at the srcip? – symcbean Oct 1 '14 at 13:24

• netstat -ab can be helpful – schroeder Oct 1 '14 at 14:22