src=localhost dst=localhost????

[Charles Stack]

As a consolation, I've been seeing it as well.  I simply put in a rule that
blocks traffic to the same interface.  Now, I'm seeing lots of other
things....like concerted efforts to access my system from individuals in
foreign countries like Brazil, Australia, France, China, and Korea with a
very large number of from China.

Could these packets with dst and src being the same be some sort of attack
(i.e. spoofing?)?

Charles

-----Original Message-----
From: netfilter-admin@lists.samba.org
[mailto:netfilter-admin@lists.samba.org]On Behalf Of Andre Luiz de
Oliveira
Sent: Thursday, July 19, 2001 4:14 PM
To: djweis@sjdjweis.com
Cc: netfilter@lists.samba.org
Subject: Re: src=localhost dst=localhost????


> > > what you are seeing is completely normal. what do you think happens
> if
> > > you
> > > telnet or browse to localhost?
> > but thats a firewall, i (think) dont have any process using that port,
> and another thing, why the state of the packets is ESTABLISHED?
>
> You can find out if something is listening by using netstat -an and
> look
> for something like
> tcp        0      0 0.0.0.0:80              0.0.0.0:*
> LISTEN
>
> or use
> /sbin/fuser -n tcp 80
> and you'll get the pid of whatever is listening to the port.
>
> dave
dave, thanx but look that i dont found anything listening the port, neither
with netstat nor with fuser.
so...????