OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Port 6502
From: Tony Lambiris (sekureMEDIAONE.NET)
Date: Sun Apr 16 2000 - 23:55:10 CDT

Check out these log messages...

Apr 16 20:35:21 sekure kernel: Packet log: input DENY eth0 PROTO=17
192.168.1.1:
6502 255.255.255.255:6502 L=136 S=0x00 I=64 F=0x0000 T=128 (#4)
Apr 16 20:35:21 sekure kernel: Packet log: input DENY eth0 PROTO=17
192.168.1.1:
6502 255.255.255.255:6502 L=136 S=0x00 I=65 F=0x0000 T=128 (#4)
Apr 16 20:35:21 sekure kernel: Packet log: input DENY eth0 PROTO=17
192.168.1.1:
6502 255.255.255.255:6502 L=136 S=0x00 I=66 F=0x0000 T=128 (#4)
Apr 16 20:35:21 sekure kernel: Packet log: input DENY eth0 PROTO=17
192.168.1.1:
6502 255.255.255.255:6502 L=136 S=0x00 I=67 F=0x0000 T=128 (#4)
Apr 16 20:35:21 sekure kernel: Packet log: input DENY eth0 PROTO=17
192.168.1.1:
6502 255.255.255.255:6502 L=136 S=0x00 I=68 F=0x0000 T=128 (#4)

I'm running a Debian system, with ipmasq (the scripts to put up dynamic
firewalls) installed, and in one of the scripts, it denys any requests
for private IP addresses that come from the external network interface.
Well, in my case, eth0 is in fact connected to the internet, and the
address it's trying to reach is 192.168.1.1. I'm just confused about the
source address being 255.255.255.255. Can some one shed light on this
(especially whats on port 6502... nothing in my /etc/services).

Thanks.