[ILUG] Where do these dropped packets come from?

[Timothy Murphy]

On Sun 01 May 2005 17:33, Paul Jakma wrote:

> Another interesting one is my ssh-scan chains:
>
> # iptables -v -L ssh-scan
> Chain ssh-scan (1 references)
>   pkts bytes target
>   6354  353K        recent: SET name: SSH side: source
>   4601  257K LOG    recent: UPDATE seconds: 60 hit_count: 8 TTL-Match name:
> SSH side: source LOG level warning prefix `SSH Scan: ' 4601  257K DROP  
> recent: UPDATE seconds: 60 hit_count: 8 TTL-Match name: SSH side: source

Thanks for your suggestions - which I don't really understand.
Am I right in thinking you are just scanning the ports of the dropped packets?
If so, wouldn't it be simpler just to run LogWatch through a Perl script?
Or is there some other information you are getting?

Am I right to deduce from your and the other replies
that the IP addresses of the dropped packets are completely irrelevant?

-- 
Timothy Murphy  
e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland