What does this ipchains log mean?

[Energon]

Okay, I'm getting this really odd log... I have this rule in my firewall:

# refuse incoming packets pretending to be from the external address.
$IPCHAINS -A input -s $IP -j DENY -l

obviously it's to block spoofed packets claiming to be from my machine... but I'm getting this log:

May 31 12:48:51 xxx kernel: Packet log: input DENY eth0 PROTO=17 xxx:138 yyy:138 L=240 S=0x00 I=0 F=0x4000 T=64 (#2)
May 31 12:48:51 xxx kernel: Packet log: input DENY eth0 PROTO=17 xxx:138 255.255.255.255:138 L=240 S=0x00 I=0 F=0x4000 T=63 (#2)

and in this case, xxx is my IP and yyy is a broadcast IP... now, call me stupid if you will, but it seems that an input packet coming from me to somebody else, doesn't make any sense whatsoever... I know it can't be somebody sending spoofed packets because if I ping the yyy address, I get this:


PING yyy (yyy): 56 octets data
64 octets from vvv: icmp_seq=0 ttl=128 time=0.6 ms
64 octets from vvv: icmp_seq=0 ttl=255 time=22.7 ms (DUP!)
64 octets from 10.0.253.1: icmp_seq=0 ttl=255 time=30.6 ms (DUP!)
64 octets from 10.0.1.1: icmp_seq=0 ttl=255 time=30.8 ms (DUP!)
64 octets from 10.0.253.1: icmp_seq=0 ttl=255 time=58.9 ms (DUP!)
64 octets from 10.0.253.1: icmp_seq=0 ttl=255 time=66.9 ms (DUP!)
64 octets from 10.0.253.1: icmp_seq=0 ttl=255 time=96.0 ms (DUP!)


the vvv spots are internet broadcast IPs and the other ones are from our internal network... which says to me that the yyy address is a broadcast address...

So, I guess my next question is, what's causing these input packets from me to somebody else? That doesn't seem like something that could possibly be happening and I'd like it to not be filling up my log, but at the same time, I have to log packets that are input from me so I can catch spoofed packets...

[vvx]

Originally posted by Energon:
<STRONG>Okay, I'm getting this really odd log... I have this rule in my firewall:

# refuse incoming packets pretending to be from the external address.
$IPCHAINS -A input -s $IP -j DENY -l

obviously it's to block spoofed packets claiming to be from my machine... but I'm getting this log:

May 31 12:48:51 xxx kernel: Packet log: input DENY eth0 PROTO=17 xxx:138 yyy:138 L=240 S=0x00 I=0 F=0x4000 T=64 (#2)
May 31 12:48:51 xxx kernel: Packet log: input DENY eth0 PROTO=17 xxx:138 255.255.255.255:138 L=240 S=0x00 I=0 F=0x4000 T=63 (#2)

and in this case, xxx is my IP and yyy is a broadcast IP... now, call me stupid if you will, but it seems that an input packet coming from me to somebody else, doesn't make any sense whatsoever... I know it can't be somebody sending spoofed packets because if I ping the yyy address, I get this:


PING yyy (yyy): 56 octets data
64 octets from vvv: icmp_seq=0 ttl=128 time=0.6 ms
64 octets from vvv: icmp_seq=0 ttl=255 time=22.7 ms (DUP!)
64 octets from 10.0.253.1: icmp_seq=0 ttl=255 time=30.6 ms (DUP!)
64 octets from 10.0.1.1: icmp_seq=0 ttl=255 time=30.8 ms (DUP!)
64 octets from 10.0.253.1: icmp_seq=0 ttl=255 time=58.9 ms (DUP!)
64 octets from 10.0.253.1: icmp_seq=0 ttl=255 time=66.9 ms (DUP!)
64 octets from 10.0.253.1: icmp_seq=0 ttl=255 time=96.0 ms (DUP!)


the vvv spots are internet broadcast IPs and the other ones are from our internal network... which says to me that the yyy address is a broadcast address...

So, I guess my next question is, what's causing these input packets from me to somebody else? That doesn't seem like something that could possibly be happening and I'd like it to not be filling up my log, but at the same time, I have to log packets that are input from me so I can catch spoofed packets...</STRONG>

May 31 12:48:51 xxx kernel: Packet log: input DENY eth0 PROTO=17 xxx:138 yyy:138 L=240 S=0x00 I=0 F=0x4000 T=64 (#2)

Obviously the time part is obvious.. This is an input, protocol 17 = udp, now the ports we're looking at are used for windows file sharing. This makes sense, because in windows file sharing it uses udp.. Furthermore the machines broadcast their info (their 'address' so to speak) so other machines can find them. That's what you're seeing. So what can you do? Assuming you don't have any non-windows machines involved in the file sharing you could change the protocol windows is using for that from tcp/ip to netbeui (my preferred, because it's non-routeable) or something else. If linux is involved you probably need to keep it using tcp/ip. I don't believe the firewall would forward it as it is destined for your network but you never know, might be wise to keep the firewall blocking it. You don't have to log it though, and to block spoofed ips' from coming in while logging them you can change your rule for that to

$IPCHAINS -A input -s $IP -i INTERFACE -j DENY -l

where interface is the interface on the firewall going to the outside world (which would be ppp0 in my case)

Hope that answers your question.