On Thu, Sep 30, 2004 at 04:33:48PM -0400, Adrian Padilla wrote:
> Sep 30 12:39:11 192.168.1.1 ipmon: 12:39:11.193084 rl0 @0:17 b
> 22.214.171.124,2227 -> 126.96.36.199,5000 PR tcp len 20 48 -S IN
> Can someone tell me what this all means in plain ole English...please
Sep 30 12:39:11 - Ye olde date
192.168.1.1 - thine server's Ip address
ipmon - thine daemon's name and process number
12:39:11.193084 - ye olde date stampe
rl0 - thine interface
@0:17 - groupe and number of rule that doth match
b - action thou filter didst taketh (b = block)
188.8.131.52,2227 - origin of packet (IP, source porte)
184.108.40.206,5000 - ye olde destination (as above)
tcp - the protocol
len 20 48 -S in - extra flags
oh, sorry, not olde english.
It means someone (220.127.116.11) tried to connect to you
(18.104.22.168) at port 5000, and was denied.
see http://ezine.daemonnews.org/200407/ipfilter.html for a field by
field explanation (look for "Format of Logged Messages").