Re: IPIP (IP Protocol 94) Probe?

Article View: comp.security.firewalls

Article #75

Back to comp.security.firewalls Previous Next

#75

From: Hal Burgiss
Date: Wed, 11 Apr 2001 00:23

24 lines
1891 bytes

On Tue, 10 Apr 2001 19:37:01 -0400, Lawrence Baldwin
<baldwinl@mynetwatchman.com> wrote:
>
>Since MNW is fed by *many* different firewalls (e.g. SonicWall,
>IPChains, etc...) I can only assume that they're not logging these kind
>of events either.  (Unless Chad coded the myNetWatchman PerlAgent to
>discard these???)

Chad is only reporting the same -- 1,6,17. AFAIK, Linux ipchains (2.2
kernel) only reports these too. 2.4 kernel does much more I believe.

Found this link on IPIP:

http://www.linuxports.com/howto/networking/x1262.htm

A Linux site, but nice explanation.

-- 
Hal B
 hal@foobox.net
 hal@burgiss.net
 hburgiss@bellsouth.net
 Spamtrap: uce@ftc.gov and report@fraud.org
--

Technical Details

Message-ID: <slrn9d78vp.qu3.hal@localhost.localdomain>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!nntp.cs.ubc.ca!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news3.mia.POSTED!localhost!hal

References:

<MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net> <slrn9d75jf.qu3.hal@localhost.localdomain> <MPG.153d631b483152ec9896a2@news2.mia.bellsouth.net>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,36dd554aa7cf6f1b
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10090f,36dd554aa7cf6f1b
X-Google-Attributes: gid10090f,public
X-Google-ArrivalTime: 2001-04-10 17:24:08 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!nntp.cs.ubc.ca!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news3.mia.POSTED!localhost!hal
From: hal@burgiss.net (Hal Burgiss)
Newsgroups: comp.security.firewalls,bellsouth.net.security
Subject: Re: IPIP (IP Protocol 94) Probe?
References: <MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net> <slrn9d75jf.qu3.hal@localhost.localdomain> <MPG.153d631b483152ec9896a2@news2.mia.bellsouth.net>
Reply-To: Hal Burgiss <hal@foobox.net>
Message-ID: <slrn9d78vp.qu3.hal@localhost.localdomain>
User-Agent: slrn/0.9.6.4 (Linux)
X-Original-NNTP-Posting-Host: 127.0.0.1
X-Original-Trace: 10 Apr 2001 20:23:21 -0400, 127.0.0.1
Lines: 24
Date: 10 Apr 2001 20:23:21 -0400
NNTP-Posting-Host: 216.78.197.8
X-Trace: news3.mia 986948607 216.78.197.8 (Tue, 10 Apr 2001 20:23:27 EDT)
NNTP-Posting-Date: Tue, 10 Apr 2001 20:23:27 EDT

Reply to Parent Message