Log Example

Apr 17 00:32:31 malice kernel: Packet log: input REJECT eth0 PROTO=6 192.168.25.3:2351 172.16.50.3:111 L=60 S=0x00 I=45086 F=0x4000 T=45 SYN (#8)

Log Structure:

Apr 17 00:32:31 System Date
malice kernel Machine Name*
Packet log Options (log)
input REJECT Traffic Direction /Target
eth0 Interface
PROTO=6 Protocol Number
192.168.25.3:2351 Source Address/Source Port
172.16.50.3:111 Dest Address/Dest Port
L=60 Packet Length (bytes)
S=0x00 TOS (Type Of Service)
I=45086 IP-ID (increments per packet)
F=0x4000 Flags (3 bits) and Fragment offset (13 bits)
T=45 Time to live (TTL) number of hops before discarded
SYN Traffic Type - Beginning of a connection
(#8) Rule Number

*Packets are processed at the kernel before reaching the OS, between layers 2 and 3.
REJECT - will send an ICMP Type 3 code 1 for each attempt.

Rule -- ipchains -A input -p tcp -d 172.16.50.3 111 -j REJECT -l

Basic Rule Structure:

ipchains -A input -p tcp -d 172.16.50.3 111 -j REJECT -l
A - Append output tcp -d destination port(s) Jump ACCEPT
I - Insert udp -s source DENY
D - Delete REJECT