sending packets

sanjibgupta · 01-03-2006, 05:26 AM

Hi

I have seen this lines in the /var/log/messages file

Jan 3 17:20:39 cb kernel: IN= OUT=lo SRC=127.0.0.2 DST=127.0.0.2 LEN=79 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1025 DPT=53 LEN=59
Jan 3 17:20:39 cb kernel: IN= OUT=lo SRC=127.0.0.2 DST=127.0.0.2 LEN=79 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1025 DPT=53 LEN=59

What does this lines means how do i stop this lines.

Sanjib Gupta

JustinHoMi · 01-03-2006, 05:58 AM

It looks like your firewall (iptables?) blocking some traffic. Those lines in particular are from blocked dns traffic. DPT is the destination port (53-DNS).

The odd thing (to me) is that those packets are completely local. You see that the source (SRC) and destination (DST) ip addresses are your local interface.

stress_junkie · 01-03-2006, 12:22 PM

You could use netstat to see what is using the ports. In all of the lines listed the source port is 1025 and the destination port is 53. Log in as root and issue these commands.

netstat -a | grep 1025
netstat -a | grep 53

You can see the command that is running in the process that is using the ports specified in the grep expression. There's probably a more elegant way to do this but this way should work.