iptables event in messages

TheRealDeal · 03-10-2005, 09:01 PM

Hi all.

Could I please ask your advise on something....

Mar 11 11:51:18 Images kernel: IN=eth0 OUT= MAC=00:00:e2:9b:f2:67:02:00:e3:98:79:6d:08:00 SRC=192.168.8.69 DST=192.168.10.182 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=34590 DF PROTO=TCP SPT=2198 DPT=139 WINDOW=64512 RES=0x00 SYN URGP=0

I get this in my /var/log/messages. Does anyone know what source port 2198 could be?

Thanks alot.
Craig.

win32sux · 03-11-2005, 03:37 AM

i'm not sure about the source port (i think it can vary from host to host), but destination port 139 is part of windows' netbios stuff... so unfortunately it's normal for your firewall to be blocking incoming 139/tcp packets (among others) from windows boxes (and worms) all night and day...

http://www.iss.net/security_center/a...39/default.htm

if you don't wanna see them get logged just add a rule to block them silently before they hit the log rule... for example:

Code:

iptables -I INPUT -p TCP --dport 139 -m state --state NEW -j DROP

just my two cents...