Ingo Schwarze wrote:
> Dear Mr. Koett,
>
> Ted Unangst schrieb am Thu, Sep 29, 2005 at 10:00:01PM -0400:
>> On Thu, 29 Sep 2005, Richard P. Koett wrote:
> [...]
>>> b) Rephrase the question?
>> yes. ask again, include more information
>
> In this particular case, you might for example
> - try tcpdump -er instead of just -r
> This might tell you whether these are incoming or outgoing
> or loopback packets.
> - note which OS version you are running (current?)
> and include the output of tcpdump -V
> - tell the list on what kind of network segment the
> respective interface is and which kind of traffic
> you would expect on that network
>
> I'm sorry i dont know what 33:0:0:0:0:0 > 3d:2:1:0:6e:65
> might mean, either - i cannot remember to have seen such
> tcpdump output before... So in a way, i'm curious, too...
>
> Hope that helps all the same,
> Ingo Schwarze
Okay, I ran 'tcpdump -evvr /var/log/pflog' and saw entries like:
09:37:39.020855 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 108: null I (s=0,r=0,C)
len=90
09:49:27.402022 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
09:49:27.946815 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
09:49:28.479792 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:04:16.389863 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 972: null I (s=0,r=0,C)
len=954
10:12:52.206911 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:12:52.747479 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:12:53.287096 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:15:46.908598 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:15:47.411027 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:15:47.844158 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:18:42.252439 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:18:42.957580 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:18:43.660591 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:19:37.303808 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 411: null I (s=0,r=0,C)
len=393
10:29:43.254878 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
10:29:44.788968 33:0:0:0:0:0 3d:2:1:0:6e:65 0000 112: null I (s=0,r=0,C)
len=94
OS version is as follows:
OpenBSD 3.7-current (GENERIC) #0: Sat Jun 4 18:58:52 PDT 2005
[EMAIL PROTECTED]:/usr/src/sys/arch/i386/compile/GENERIC
tcpdump -V shows:
tcpdump version 3.4.0
libpcap version 0.5
This machine has two interfaces - 'ne3' facing the Internet and 'rl0'
facing a small (3 computer) internal network. I am *assuming* that the
log entries pertain to the external interface but tcpdump is not showing
some information (such as block in/out, interface name, pf.conf rule
number) that it shows with other log entries.
As far as I know things are working fine - I'm just curious to know more
about what these events mean. As mentioned previously I haven't found
much help via Google or archives.
If there is anything else I can do to provide better information please
let me know.
