[ILUG] Where do these dropped packets come from?

[Anders Holm]

A quick google revealed this link, as one example:
http://www.linklogger.com/TCP15118.htm

So, yes, it does seem to be you are being scanned for vulnerabilities. 
Hopefully they'll decrease once the script kiddies and worms realise 
that you are blocking those ports.... Then again these people tend not 
to be the brightest ones around...

//Anders

Timothy Murphy wrote:

>My daily logwatch contains lists of dropped packets, like
>=======================================
>Dropped 122 packets on interface ppp0
>  From 12.240.48.151 - 2 packets to tcp(15118)
>  From 24.152.208.90 - 2 packets to tcp(15118)
>  From 60.191.1.165 - 1 packet to udp(1434)
>  From 61.129.34.19 - 1 packet to udp(1434)
>...
>=======================================
>As a matter of interest, where do these packets come from?
>Are they all attempted intruders, 
>or could people have a genuine reason for sending them?
>
>Incidentally, the number of dropped packets has been falling
>fairly steadily for some time.
>Is that a general phenomenon?
>
>  
>