[ previous ] [ next ] [ threads ]
 
 From:  "Matthew Steinblock" <matthew at mksolutions dot net>
 To:  <m0n0wall at lists dot m0n0 dot ch>
 Subject:  Log question
 Date:  Thu, 10 Feb 2005 23:39:11 -0500
I am getting the following log entry pretty frequently lately.  

Act TIME            If  Source                 Destination
Proto
X17 22:21:53.381441 DMZ 192.168.1.100, port 80 152.163.100.139, port
38345 TCP  

The X means blocked.  What does the 17 mean.  Most entries do not have a
number under Act, while others will have anything from 2 to 17.  

The DMZ is set up to allow everything except LAN.  Why is this being
blocked?  Why always a bunch of these entries together with just one
port difference? 

Thanks!
 

Matthew Steinblock