This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Why Would Astaro Be Sending Me IDENT Packets

Just noticed this in my firewall live log:

09:30:01 Default DROP Ident
213.144.15.7 : 49649
→
mypublicip : 113

[SYN] len=60 ttl=49 tos=0x00 srcmac=0:1d:45:70:7e:e2 dstmac=0:2:a5:5c:9a:15
09:30:04 Default DROP Ident
213.144.15.7 : 49649
→
mypublicip : 113

[SYN] len=60 ttl=49 tos=0x00 srcmac=0:1d:45:70:7e:e2 dstmac=0:2:a5:5c:9a:15
09:30:08 Default DROP Ident
213.144.15.7 : 43771
→
mypublicip : 113

[SYN] len=60 ttl=49 tos=0x00 srcmac=0:1d:45:70:7e:e2 dstmac=0:2:a5:5c:9a:15
09:30:11 Default DROP Ident
213.144.15.7 : 43771
→
mypublicip : 113

The source IP address resolves to Astaro in Karlsruhe. Just curious as to why this would be happening.

Bob

This thread was automatically locked due to age.

0 BAlfson over 12 years ago

Hi, Bob,

I just checked two places where I don't have the rule below - one started receiving this on the 19th and the other yesterday.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 robertobrinsky over 12 years ago

They are rejected by default on my system. I am just trying to figure out why it would be coming from an IP address assigned to Astaro. Seems odd, that's all.
Cancel
Vote Up 0 Vote Down

Cancel
0 robertobrinsky over 12 years ago

Actually, I meant to say they are dropped, not rejected. I don't like responding to unsolicited SYN packets since I am not running any services that would require this.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 12 years ago

Here's a good discussion about using Reject instead of Drop for IDENT.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 12 years ago

Bob, I agree about using REJECT for IDENT (if running a mailserver), but still, why is he seeing this traffic from Astaro.de?

Barry
Cancel
Vote Up 0 Vote Down

Cancel