On 11/10/05, berek at rz dot uni dash leipzig dot de <berek at rz dot uni dash leipzig dot de> wrote:
>
> those where not the source ports but the destination ports. that means they
> followed the ip adress of the (internet) location where the local network node
> had its connection to.
>
> i upgraded yesterday to m0n0 1.2 and hope to find some more info in the (very
> cool indeed) fw state table.
>


Probably more useful would be to enable logging on all your firewall
rules, and see what you get from that.

-Chris