Левые пакеты, на шлюзе

mayor · Непрочитанное сообщение **mayor** » 2011-01-27 10:52:38

Есть шлюз на 8.1 через него выпускаются в нет несколько IP, но заметил странную вещь: идут пакеты для адреса 192.168.1.183 который не ходит через мой шлюз, и которого в данный момент даже нет в сети но какие-то пакеты идут на него - что это такое и как объяснить это все?:

Код: Выделить всё

06:43:32.545633 IP 115.118.210.28.static-delhi.vsnl.net.in.30813 > 192.168.1.183.35691: UDP, length 103
06:43:33.209923 IP dslb-188-107-012-040.pools.arcor-ip.net.3635 > 192.168.1.183.35691: Flags [S], seq 1863304751, win 32767, options [mss 1440,nop,wscale 0,nop,nop,sackOK], length 0
06:43:33.372543 IP 77.35.38.109.34400 > 192.168.1.183.35691: UDP, length 30
06:43:33.753611 IP ppp95-165-78-251.pppoe.spdop.ru.60678 > 192.168.1.183.35691: UDP, length 67
06:43:36.047978 IP dslb-188-107-012-040.pools.arcor-ip.net.3635 > 192.168.1.183.35691: Flags [S], seq 1863304751, win 32767, options [mss 1440,nop,wscale 0,nop,nop,sackOK], length 0
06:43:37.588038 IP host192-67.nat-pool1.aviel.ru.1974 > 192.168.1.183.35691: Flags [S], seq 1953696934, win 8192, options [mss 1440,nop,nop,sackOK], length 0
06:43:37.785780 IP 217.118.93.96.34883 > 192.168.1.183.35691: UDP, length 106
06:43:39.235557 IP p3215-ipbf206niigatani.niigata.ocn.ne.jp.53574 > 192.168.1.183.35691: UDP, length 103
06:43:39.369788 IP 211.194.13.140.47951 > 192.168.1.183.35691: UDP, length 103
06:43:39.593302 IP 182.215.221.83.static.donpac.ru.33687 > 192.168.1.183.35691: UDP, length 67
06:43:41.355946 IP 91.143.51.125.59519 > 192.168.1.183.35691: UDP, length 67
06:43:42.034065 IP dslb-188-107-012-040.pools.arcor-ip.net.3635 > 192.168.1.183.35691: Flags [S], seq 1863304751, win 32767, options [mss 1440,nop,wscale 0,nop,nop,sackOK], length 0
06:43:42.719498 IP pool-71-111-143-124.ptldor.dsl-w.verizon.net.27519 > 192.168.1.183.35691: UDP, length 103
06:43:43.550898 IP X86.bbn2-104.lipetsk.ru.42806 > 192.168.1.183.35691: UDP, length 67
06:43:45.359644 IP 178.122.248.66.30001 > 192.168.1.183.35691: UDP, length 67
06:43:45.455701 IP adsl-227-197-192-81.adsl.iam.net.ma.57592 > 192.168.1.183.35691: UDP, length 103
06:43:45.935716 IP 93-84-46-224.pppoe.vitebsk.by.36005 > 192.168.1.183.35691: UDP, length 30
06:43:46.197783 IP 195.114.130.130.gds_db > 192.168.1.183.35691: UDP, length 106
06:43:48.297073 IP 188.128.4.214.bytex > 192.168.1.183.35691: UDP, length 30
06:43:50.368482 IP 93-96-191-183.zone4.bethere.co.uk.62758 > 192.168.1.183.35691: UDP, length 103
06:43:50.384403 IP 219.73.broadband14.iol.cz.18756 > 192.168.1.183.35691: UDP, length 67
06:43:51.288641 IP 188.128.4.214.bytex > 192.168.1.183.35691: UDP, length 30
06:43:52.583388 IP client-77-87-69-96.atricom.ru.50868 > 192.168.1.183.35691: UDP, length 103
06:43:52.890213 IP ip-81-11-217-31.dsl.scarlet.be.14524 > 192.168.1.183.35691: UDP, length 106
06:43:52.943579 IP 85-7-191-213.fttb.ur.ru.23557 > 192.168.1.183.35691: UDP, length 67
06:43:53.960050 IP ppp-71-137-137-87.dsl.sndg02.pacbell.net.65243 > 192.168.1.183.35691: UDP, length 103
06:43:56.620667 IP 101-66.114.92.tvb.ro.20490 > 192.168.1.183.35691: UDP, length 103
06:43:56.915155 IP 178.47.214.126.52575 > 192.168.1.183.35691: UDP, length 67
06:43:58.256775 IP 78.149.255.160.16010 > 192.168.1.183.35691: UDP, length 103
06:43:59.067334 IP cpc1-hatf6-0-0-cust160.9-3.cable.virginmedia.com.63718 > 192.168.1.183.35691: UDP, length 103
06:43:59.194941 IP 93.100.229.62.14406 > 192.168.1.183.35691: UDP, length 30
06:44:02.222509 IP 93.100.229.62.14406 > 192.168.1.183.35691: UDP, length 30
06:44:04.427526 IP 95.72.18.140.22153 > 192.168.1.183.35691: UDP, length 67
06:44:04.990477 IP 84.51.216.159.36857 > 192.168.1.183.35691: UDP, length 30
06:44:04.998889 IP 84.51.216.159.62345 > 192.168.1.183.35691: Flags [S], seq 3650243388, win 8192, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
06:44:06.076126 IP 188.123.252.197.54918 > 192.168.1.183.35691: Flags [S], seq 4230229856, win 8192, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
06:44:08.001781 IP 84.51.216.159.62345 > 192.168.1.183.35691: Flags [S], seq 3650243388, win 8192, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
06:44:08.002008 IP 84.51.216.159.36857 > 192.168.1.183.35691: UDP, length 30
06:44:09.069295 IP 188.123.252.197.54918 > 192.168.1.183.35691: Flags [S], seq 4230229856, win 8192, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
06:44:09.197048 IP 112.221.196.189.20289 > 192.168.1.183.35691: UDP, length 103
06:44:10.371525 IP 213.140.231.19.57375 > 192.168.1.183.35691: UDP, length 106
06:44:12.325275 IP 113.193.105.177.40446 > 192.168.1.183.35691: UDP, length 103
06:44:13.025137 IP 211.57.PPPoE.fregat.ua.2058 > 192.168.1.183.35691: Flags [S], seq 3409093878, win 65535, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
06:44:18.672436 IP 67-197-179-110.dyn.comporium.net.34537 > 192.168.1.183.35691: UDP, length 103
06:44:19.899754 IP pppoe.95-55-186-173.dynamic.avangarddsl.ru.1973 > 192.168.1.183.35691: Flags [S], seq 287945548, win 64320, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
06:44:21.972048 IP 211.57.PPPoE.fregat.ua.2058 > 192.168.1.183.35691: Flags [S], seq 3409093878, win 65535, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
06:44:22.767432 IP pppoe.178-66-200-28.dynamic.avangarddsl.ru.59039 > 192.168.1.183.35691: UDP, length 67
06:44:23.483162 IP 115.118.216.113.static-delhi.vsnl.net.in.54300 > 192.168.1.183.35691: UDP, length 103
06:44:25.676770 IP broadband-77-37-253-49.nationalcablenetworks.ru.26875 > 192.168.1.183.35691: UDP, length 106
06:44:25.794751 IP 11.196.104.109.bergon.net.57292 > 192.168.1.183.35691: Flags [S], seq 1202142524, win 8192, options [mss 1440,nop,nop,sackOK], length 0
06:44:25.798688 IP 11.196.104.109.bergon.net.31869 > 192.168.1.183.35691: UDP, length 30
06:44:25.939481 IP pppoe.95-55-186-173.dynamic.avangarddsl.ru.1973 > 192.168.1.183.35691: Flags [S], seq 287945548, win 65535, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
06:44:26.675811 IP R223058.ppp.dion.ne.jp.21276 > 192.168.1.183.35691: UDP, length 98
06:44:27.313759 IP 87-121-30-68.telecablenet.com.2311 > 192.168.1.183.35691: UDP, length 62
06:44:28.186270 IP 195.66.157.13.4347 > 192.168.1.183.35691: Flags [S], seq 1450160580, win 65535, options [mss 1440,nop,nop,sackOK], length 0
06:44:28.270706 IP 95.59.119.95.1236 > 192.168.1.183.35691: Flags [S], seq 4276090260, win 64240, options [mss 1440,nop,wscale 0,nop,nop,TS val 0 ecr 0,nop,nop,sackOK], length 0
06:44:28.746443 IP dynamic-83-246-178-93.intelbi.ru.2718 > 192.168.1.183.35691: Flags [S], seq 2208487328, win 65535, options [mss 1440,nop,nop,sackOK], length 0
06:44:28.791114 IP 11.196.104.109.bergon.net.31869 > 192.168.1.183.35691: UDP, length 30
06:44:28.800622 IP 11.196.104.109.bergon.net.57292 > 192.168.1.183.35691: Flags [S], seq 1202142524, win 8192, options [mss 1440,nop,nop,sackOK], length 0
06:44:30.433861 IP dslb-188-107-012-040.pools.arcor-ip.net.3890 > 192.168.1.183.35691: Flags [S], seq 3317833431, win 32767, options [mss 1440,nop,wscale 0,nop,nop,sackOK], length 0
06:44:31.184386 IP 195.66.157.13.4347 > 192.168.1.183.35691: Flags [S], seq 1450160580, win 65535, options [mss 1440,nop,nop,sackOK], length 0
06:44:31.212559 IP 95.59.119.95.1236 > 192.168.1.183.35691: Flags [S], seq 4276090260, win 64240, options [mss 1440,nop,wscale 0,nop,nop,TS val 0 ecr 0,nop,nop,sackOK], length 0
06:44:31.475907 IP bzq-82-81-165-83.red.bezeqint.net.57216 > 192.168.1.183.35691: UDP, length 101
06:44:31.668409 IP dynamic-83-246-178-93.intelbi.ru.2718 > 192.168.1.183.35691: Flags [S], seq 2208487328, win 65535, options [mss 1440,nop,nop,sackOK], length 0
06:44:32.240261 IP bb121-7-67-74.singnet.com.sg.56598 > 192.168.1.183.35691: UDP, length 103
06:44:32.586756 IP bzq-82-81-165-83.red.bezeqint.net.57216 > 192.168.1.183.35691: UDP, length 101
06:44:33.411116 IP dslb-188-107-012-040.pools.arcor-ip.net.3890 > 192.168.1.183.35691: Flags [S], seq 3317833431, win 32767, options [mss 1440,nop,wscale 0,nop,nop,sackOK], length 0
06:44:34.820322 IP 11.196.104.109.bergon.net.57292 > 192.168.1.183.35691: Flags [S], seq 1202142524, win 8192, options [mss 1440,nop,nop,sackOK], length 0
06:44:34.820347 IP 11.196.104.109.bergon.net.57292 > 192.168.1.183.35691: Flags [S], seq 1202142524, win 8192, options [mss 1440,nop,nop,sackOK], length 0
06:44:35.911478 IP bl21-227-53.dsl.telepac.pt.38262 > 192.168.1.183.35691: UDP, length 106

Хостинг HostFood.ru · **Хостинг HostFood.ru**

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

dmtr · Непрочитанное сообщение **dmtr** » 2011-01-27 11:24:33

это вывод tcpdump с какими параметрами?

и покажите

Код: Выделить всё

arp -a

upd: похоже на запросы к торрент клиенту

mayor · Непрочитанное сообщение **mayor** » 2011-01-27 11:39:34

Код: Выделить всё

(07:39:14)</usr/home/putin> #arp -a
? (192.168.1.106) at 00:e0:4d:30:96:1b on dc0 expires in 905 seconds [ethernet]
? (192.168.1.108) at 00:1b:fc:b0:e1:ac on dc0 expires in 1178 seconds [ethernet]
? (192.168.1.66) at 00:e0:4d:45:1f:8f on dc0 expires in 1199 seconds [ethernet]
? (192.168.1.135) at 00:1f:e2:54:3b:83 on dc0 expires in 978 seconds [ethernet]
? (192.168.1.38) at 00:00:00:20:fa:3c on dc0 expires in 536 seconds [ethernet]
? (192.168.1.57) at 00:30:18:a8:6e:24 on dc0 expires in 998 seconds [ethernet]
? (192.168.1.184) at 00:e0:4d:61:bd:13 on dc0 expires in 1018 seconds [ethernet]
? (192.168.1.250) at 00:16:ec:db:5e:55 on dc0 expires in 1131 seconds [ethernet]
? (192.168.1.125) at 00:16:e6:62:39:87 on dc0 expires in 734 seconds [ethernet]
? (192.168.1.93) at 00:19:db:7a:40:34 on dc0 expires in 1139 seconds [ethernet]
? (192.168.1.61) at 00:0e:e8:89:96:5e on dc0 expires in 915 seconds [ethernet]
? (192.168.1.255) at (incomplete) on dc0 expired [ethernet]
? (192.168.1.158) at 00:02:44:7e:29:66 on dc0 expires in 607 seconds [ethernet]
? (192.168.1.190) at 00:e0:4d:6d:27:70 on dc0 expires in 1143 seconds [ethernet]
? (192.168.1.144) at 00:11:d8:02:26:a3 on dc0 expires in 1013 seconds [ethernet]
? (192.168.1.243) at 00:e0:4d:39:6d:8a on dc0 expires in 526 seconds [ethernet]
? (192.168.1.115) at 00:24:54:5a:51:c1 on dc0 expires in 990 seconds [ethernet]
? (192.168.1.114) at 00:e0:4d:61:7c:eb on dc0 expires in 295 seconds [ethernet]
? (192.168.1.18) at 00:1d:92:85:9a:a0 on dc0 expires in 897 seconds [ethernet]
? (192.168.1.215) at 00:24:54:7d:94:8f on dc0 expires in 104 seconds [ethernet]

вывод такой:\

Код: Выделить всё

tcpdump -i dc0 host 192.168.1.183

dmtr · Непрочитанное сообщение **dmtr** » 2011-01-27 11:53:15

скромная фантазия подсказывет мне, что дело могло быть так:
кто-то либо включил комп 192.168.1.183, либо сменил себе ip на 192.168.1.183. включил торрент-клиент, покачал что ему надо, выключил (сменил ip). а торрент-клиенты, которые хавали его раздачу, продолжают к нему ломиться.

наблюдал аналогичную ситуацию у себя (именно в таком случае - отключил торрент-клиент, а запросы продолжали валиться), но правда у меня проброс порта с внешнего интерфейса на адрес в локалке настроен, соответственно запросы приходили на внешний ip и пробрасывались. а вот если у вас проброс не настроен, то моя версия не похожа на правду, так как удаленные клиенты не знают адреса компа в локалке.

mayor · Непрочитанное сообщение **mayor** » 2011-01-27 11:56:19

проброса нет....

mayor · Непрочитанное сообщение **mayor** » 2011-01-28 12:59:53

вчера пакеты пропали неожиданно, сегодня понеслась опять - вот как это можна обяснить?

Код: Выделить всё

(11:49:50)</usr/ports/net/arping> #tcpdump -n -e -ttt -i pflog0 
tcpdump: WARNING: pflog0: no IPv4 address assigned 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode 
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 96 bytes 
00:00:00.000000 rule 11/0(match): block in on dc0: 192.168.1.210.43057 > 85.26.164.183.35691: UDP, length 30 
00:00:02.006697 rule 10/0(match): block in on dc0: 192.168.1.210.2568 > 85.26.164.183.35691:  tcp 28 [bad hdr length 0 - too short, < 20] 
00:00:02.900276 rule 10/0(match): block in on dc0: 192.168.1.210.2568 > 85.26.164.183.35691:  tcp 28 [bad hdr length 0 - too short, < 20] 
00:00:02.094846 rule 11/0(match): block in on dc0: 192.168.1.210.43057 > 87.110.102.247.35691: UDP, length 103 
00:00:03.921282 rule 10/0(match): block in on dc0: 192.168.1.210.2568 > 85.26.164.183.35691:  tcp 28 [bad hdr length 0 - too short, < 20] 
00:00:01.064812 rule 11/0(match): block in on dc0: 192.168.1.210.43057 > 109.184.169.239.35691: UDP, length 30 
00:00:02.998741 rule 11/0(match): block in on dc0: 192.168.1.210.43057 > 109.184.169.239.35691: UDP, length 30 
00:00:03.017865 rule 11/0(match): block in on dc0: 192.168.1.210.43057 > 89.209.101.172.35691: UDP, length 103 
00:00:00.003326 rule 10/0(match): block in on dc0: 192.168.1.210.2575 > 109.184.169.239.35691:  tcp 28 [bad hdr length 0 - too short, < 20] 
00:00:02.869946 rule 10/0(match): block in on dc0: 192.168.1.210.2575 > 109.184.169.239.35691: [|tcp] 
00:00:05.705140 rule 11/0(match): block in on dc0: 192.168.1.210.43057 > 87.117.142.17.35691: UDP, length 103 
00:00:00.311419 rule 10/0(match): block in on dc0: 192.168.1.210.2575 > 109.184.169.239.35691:  tcp 28 [bad hdr length 0 - too short, < 20] 
^C 
12 packets captured 
12 packets received by filter 
0 packets dropped by kernel 
(11:50:27)</usr/ports/net/arping> #pfctl -sr 
block drop out log quick on dc0 inet proto tcp from any to 192.168.1.183 
block drop out log quick on dc0 inet proto udp from any to 192.168.1.183 
block drop in log quick on ng0 inet proto tcp from any to 192.168.1.183 
block drop in log quick on ng0 inet proto udp from any to 192.168.1.183 
block drop in log quick on dc0 inet proto tcp from any to 192.168.1.183 
block drop in log quick on dc0 inet proto udp from any to 192.168.1.183 
block drop out log quick on ng0 inet proto tcp from any to 192.168.1.183 
block drop out log quick on ng0 inet proto udp from any to 192.168.1.183 
block drop in log quick on ng0 proto tcp from any to any port = 35691 
block drop in log quick on ng0 proto udp from any to any port = 35691 
block drop in log quick on dc0 proto tcp from any to any port = 35691 
block drop in log quick on dc0 proto udp from any to any port = 35691 
pass all flags S/SA keep state 
(11:50:34)</usr/ports/net/arping> #tcpdump -i dc0 host 192.168.1.183 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode 
listening on dc0, link-type EN10MB (Ethernet), capture size 96 bytes 
11:51:26.869651 IP 132.98.199-77.rev.gaoland.net.64330 > 192.168.1.183.35691: UDP, length 103 
11:51:27.695056 IP cpe-24-165-85-119.socal.res.rr.com.14536 > 192.168.1.183.35691: UDP, length 103 
11:51:29.362559 ARP, Request who-has 192.168.1.183 tell 192.168.1.117, length 46 
11:51:32.699786 IP cpe-24-165-85-119.socal.res.rr.com.14536 > 192.168.1.183.35691: UDP, length 103 
11:51:35.976396 IP 109.194.193.141.64725 > 192.168.1.183.35691: UDP, length 103 
11:51:37.198543 IP 77.66.209.187.39641 > 192.168.1.183.35691: UDP, length 67 
11:51:37.806694 ARP, Request who-has 192.168.1.183 tell 192.168.1.117, length 46 
11:51:38.910404 IP pool-94.24.236-117.is74.ru.32047 > 192.168.1.183.35691: UDP, length 67 
11:51:39.365993 IP customer.ae-2.2025.orel-rgr2.cnt.ip.rostelecom.ru.1066 > 192.168.1.183.35691: UDP, length 67 
11:51:39.702713 IP 5400E03C.dsl.pool.telekom.hu.11984 > 192.168.1.183.35691: UDP, length 103 
11:51:42.063655 IP ppp089210200171.dsl.hol.gr.57017 > 192.168.1.183.35691: UDP, length 103 
11:51:43.894639 IP nat-shaper-0.serviceline.ru.53050 > 192.168.1.183.35691: UDP, length 67 
11:51:44.319036 IP 2.95.136.147.35691 > 192.168.1.183.35691: UDP, length 67 
11:51:44.332570 IP 109-126-195-242.domolink.elcom.ru.6881 > 192.168.1.183.35691: UDP, length 101
^C 
14 packets captured 
4662 packets received by filter 
0 packets dropped by kernel 
(11:51:45)</usr/ports/net/arping> #tcpdump -n -e -ttt -i pflog0 
tcpdump: WARNING: pflog0: no IPv4 address assigned 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode 
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 96 bytes 
00:00:00.000000 rule 11/0(match): block in on dc0: 192.168.1.210.43057 > 85.26.164.183.35691: UDP, length 30 
00:00:01.999814 rule 10/0(match): block in on dc0: 192.168.1.210.2607 > 85.26.164.183.35691:  tcp 28 [bad hdr length 0 - too short, < 20] 
00:00:01.000637 rule 11/0(match): block in on dc0: 192.168.1.210.43057 > 85.26.164.183.35691: UDP, length 30 
00:00:05.015606 rule 10/0(match): block in on dc0: 192.168.1.210.2607 > 85.26.164.183.35691:  tcp 28 [bad hdr length 0 - too short, < 20] 
^C 
4 packets captured 
4 packets received by filter 
0 packets dropped by kernel 
(11:52:15)</usr/ports/net/arping> #tcpdump -i dc0 host 192.168.1.183 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode 
listening on dc0, link-type EN10MB (Ethernet), capture size 96 bytes 
11:52:19.025143 IP 121.212.0.100.58540 > 192.168.1.183.35691: UDP, length 103 
11:52:19.994299 IP 188.126.16.8.43993 > 192.168.1.183.35691: UDP, length 98 
11:52:22.385434 IP bband-dyn4.178-40-48.t-com.sk.12168 > 192.168.1.183.35691: UDP, length 103 
11:52:22.657654 IP 178.163.74.82.32333 > 192.168.1.183.35691: UDP, length 30

:

dmtr · Непрочитанное сообщение **dmtr** » 2011-01-28 13:22:59

вирусы в локалке?

dmtr · Непрочитанное сообщение **dmtr** » 2011-01-28 13:24:34

192.168.1.210 - куда-то ломился на тот же порт? он есть в локалке?

mayor · Непрочитанное сообщение **mayor** » 2011-01-28 13:38:56

dmtr писал(а):192.168.1.210 - куда-то ломился на тот же порт? он есть в локалке?

да есть, ломится (вчера не ломился было тоже самое)

mayor · Непрочитанное сообщение **mayor** » 2011-01-28 13:39:43

вот уже ipfw включил - парадокс....:\

Код: Выделить всё

(12:37:37)</usr/home/putin> #ipfw show
00100        0           0 deny log logamount 5 ip from any to 192.168.1.183
00200        0           0 deny log logamount 5 ip from any to 192.168.1.0/24 dst-port 35691
00300        0           0 deny log logamount 5 ip from any to any dst-port 35691
65535 98989141 47757295680 allow ip from any to any
(12:37:39)</usr/home/putin> #tcpdump -i dc0 port 35691
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on dc0, link-type EN10MB (Ethernet), capture size 96 bytes
12:37:49.053846 IP dslb-092-075-218-155.pools.arcor-ip.net.53371 > 192.168.1.183.35691: Flags [S], seq 3845481171, win 8192, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
12:37:49.054073 IP dslb-092-075-218-155.pools.arcor-ip.net.11347 > 192.168.1.183.35691: UDP, length 30
12:37:49.577335 IP ppp109-252-64-230.pppoe.spdop.ru.39145 > 192.168.1.183.35691: UDP, length 67
12:37:50.060495 IP 167-153-113-92.pool.ukrtel.net.12762 > 192.168.1.183.35691: UDP, length 103
12:37:52.052933 IP dslb-092-075-218-155.pools.arcor-ip.net.53371 > 192.168.1.183.35691: Flags [S], seq 3845481171, win 8192, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
12:37:52.071741 IP dslb-092-075-218-155.pools.arcor-ip.net.11347 > 192.168.1.183.35691: UDP, length 30
12:37:52.466724 IP 87.97.128.228.24896 > 192.168.1.183.35691: UDP, length 103
12:37:53.096229 IP 33-60.dynamic.well-comm.ru.32542 > 192.168.1.183.35691: UDP, length 67
12:37:54.654910 IP 94.190.77.129.11115 > 192.168.1.183.35691: UDP, length 103
12:37:56.822645 IP n227-h14.alliance-telecom.net.49515 > 192.168.1.183.35691: Flags [S], seq 223923018, win 8192, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
12:37:58.054688 IP dslb-092-075-218-155.pools.arcor-ip.net.53371 > 192.168.1.183.35691: Flags [S], seq 3845481171, win 8192, options [mss 1440,nop,nop,sackOK], length 0
12:37:58.122131 IP 92.98.168.17.41491 > 192.168.1.183.35691: UDP, length 103
12:37:59.824957 IP n227-h14.alliance-telecom.net.49515 > 192.168.1.183.35691: Flags [S], seq 223923018, win 8192, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
^C
13 packets captured
7334 packets received by filter
0 packets dropped by kernel

deny - а пакеты идут типа мимо....

dmtr · Непрочитанное сообщение **dmtr** » 2011-01-28 17:03:06

покажите

Код: Выделить всё

uname -r
ifconfig
netstat -rn

mayor · Непрочитанное сообщение **mayor** » 2011-01-28 17:09:58

Код: Выделить всё

(16:08:55)</usr/home/putin> #uname -r
8.1-RELEASE-p2
(16:09:01)</usr/home/putin> #ifconfig
dc0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=80008<VLAN_MTU,LINKSTATE>
        ether 00:1d:0f:bd:84:18
        inet 192.168.1.143 netmask 0xffffff00 broadcast 192.168.1.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
ipfw0: flags=8801<UP,SIMPLEX,MULTICAST> metric 0 mtu 65536
pfsync0: flags=0<> metric 0 mtu 1460
        syncpeer: 224.0.0.240 maxupd: 128
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33200
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=3<RXCSUM,TXCSUM>
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x7
        inet6 ::1 prefixlen 128
        inet 127.0.0.1 netmask 0xff000000
        nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
ng0: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1460
        inet 194.44.101.44 --> 192.168.101.1 netmask 0xffffffff
(16:09:11)</usr/home/putin> #netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.101.1      UGS         0  8445039    ng0
127.0.0.1          link#7             UH          0   265032    lo0
192.168.1.0/24     link#2             U           7 33842143    dc0
192.168.1.143      link#2             UHS         0       93    lo0
192.168.101.1      link#8             UH          0        0    ng0
194.44.101.44      link#8             UHS         0        0    lo0

Internet6:
Destination                       Gateway                       Flags      Netif Expire
::1                               ::1                           UH          lo0
fe80::%lo0/64                     link#7                        U           lo0
fe80::1%lo0                       link#7                        UHS         lo0
ff01:7::/32                       fe80::1%lo0                   U           lo0
ff02::%lo0/32                     fe80::1%lo0                   U           lo0
(16:09:19)</usr/home/putin> #

forum.lissyara.su

Левые пакеты, на шлюзе

Левые пакеты, на шлюзе

Услуги хостинговой компании Host-Food.ru

Re: Левые пакеты, на шлюзе

Re: Левые пакеты, на шлюзе

Re: Левые пакеты, на шлюзе

Re: Левые пакеты, на шлюзе

Re: Левые пакеты, на шлюзе

Re: Левые пакеты, на шлюзе

Re: Левые пакеты, на шлюзе

Re: Левые пакеты, на шлюзе

Re: Левые пакеты, на шлюзе

Re: Левые пакеты, на шлюзе

Re: Левые пакеты, на шлюзе