Linux port usage interpertation?
--------------------------------

In trying to further improve my Linux (AppleTalk server) Mac (client) LAN I've been (in part) looking at the Mac OS X firewall log. For Mac to Mac traffic I use the support document <the forum rejected the url reference :-P > as a guide. I would think that such might generally apply to Linux also, but I can't seem to find a similar guide for Linux.

More specifically, I don't understand the following Linux related "denied" entries in the OS X firewall log.

legend: <prefix> = "ipfw 12190"
<from> = url of Linux box on LAN as 192.168.x.xx
<to> = url of Mac on LAN as 192.168.x.xx
<suffix> = "via en0" (Belkin router - ethernet 0)

<prefix> <from>:49658 <to>:79 <suffix>
:58724 :80
:58725 :80
:58726 :80
:58727 :80
:43600 :49932
:52405 :49933
:35367 :49936
:33708 :49937
:47891 :50802
:41822 :50803
:1057 :5000
:1058 :5000
:1059 :5000
:1065 :5000


Any pointers would be appreciated :-)

Thank you
Lee C

:58724 :80
:58725 :80
:58726 :80
:58727 :80

Looks like randomly obtained ports on the Linux side (58724-58727) tried to hit the well known web port 80 on the Mac side and the Mac side prevent them. Since 80 is a root level port that's a good thing - did you try hitting 8180 instead?

Do a google for "well known ports" for a list of same. Also looking at /etc/services file will give you a lot of the common ones. It is normal for one side to be somewhat random unless you're doing a defined client/server application that clearly defines each side.

The command "lsof" for Unix/Linux can show you which processes have which ports open (as opposed to netstat -a which will only show you which ports are open but not tie them to specific processes). Since your list is "denied" entries they likely died right after making the attempt.

Thanks jlightner