Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 2 subscribers
  • Views 1433 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

too much memory .... and emule

Chris_W
hello,

again i got some problem with my asl-box.

i defined broadcast-drop-rules to reduce log-files.
still i get ASL-hangs because of to large log-files.
this has to do with e-mule, i guess.

file sizes grow like:
2003-01-08 81.93 KByte
003-01-09 105.72 KByte
2003-01-10 794.81 KByte
2003-01-11 4.28 MByte
2003-01-12 15.07 MByte
2003-01-13 appending .... reboot necessery
(both on filter and kernel-log)

entries look like:
Jan 10 00:11:56 (none) kernel: UDP Drop: IN=eth2 OUT=eth0 SRC=129.125.105.134 DST=a.b.c.d LEN=68 TOS=0x00 PREC=0x00 TTL=114 ID=19187 PROTO=UDP SPT=3202 DPT=1214 LEN=48 
Jan 10 00:11:56 (none) kernel: TCP Drop: IN=eth2 OUT=eth0 SRC=212.172.16.14 DST=a.b.c.d LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=19409 DF PROTO=TCP SPT=42007 DPT=113 WINDOW=5840 RES=0x00 SYN URGP=0 

i tried to drop these with a rule like
any portnr my_ip_a.b.c.d drop
but the entries seemed to continue.
now i have 
any any my_ip_a.b.c.d allow,
and it seemed to stop the entries.

anyone knows what is the secret on these entries?
and why are they doubled?
(kernel-log and filter-log)

kind regards,
christian


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Fausto Oliveira
    Hi alltogether,

    as German Telekom user my firewall connected to DSL
    is also heavily hit by those Kazaa and other peer to
    peer network syn packets.
    To calm down my hdd I went to DEFINITIONS/SERVICES
    and defined the kazaa port range as well as port
    1214 and Netbios(through NAT)

    kaaza tcp 1024:65535 4661:4662
    kaazaa_another tcp 1024:65535 6346
    kaazaa_udp udp 1024:65535 4665
    netbios_NAT tcp/udp 1024:65535 135:139
    unwanted_1214 tcp 1024:65535 1214

    grouped them together in "unwanted_hdd_heaters"
    and configured one packet filter rule

    code:
    ANY unwanted_hdd_heaters IP-of-external-IF DROP 
    Happy dropping
    o|iver