This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Questions to my firewall log

I get a lot of the following messages in my firewall log. The source is my exchange server, which seems to be interrupted in its communication, but I don't quite get it. What is the reason for this problem?

2013:12:27-17:30:38 gate ulogd[4655]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="******" dstmac="******x" srcip="10.64.0.22" dstip="10.64.0.10" proto="6" length="52" tos="0x00" prec="0x00" ttl="128" srcport="443" dstport="56174" tcpflags="ACK FIN"
2013:12:27-17:30:38 gate ulogd[4655]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="******xx" dstmac="******x" srcip="10.64.0.22" dstip="10.64.0.10" proto="6" length="153" tos="0x00" prec="0x00" ttl="128" srcport="443" dstport="56174" tcpflags="ACK PSH FIN"

This thread was automatically locked due to age.

Parents

0 BarryG over 11 years ago

Hi, ACK FIN's in the log are normally just noise from timed-out TCP sessions.

If you're not having any problems, they can be ignored.

If there are far too many of them, there's a way to stop them from logging.

An example of how to stop them from logging for a WebServer is at
https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/39325

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BarryG over 11 years ago

Hi, ACK FIN's in the log are normally just noise from timed-out TCP sessions.

If you're not having any problems, they can be ignored.

If there are far too many of them, there's a way to stop them from logging.

An example of how to stop them from logging for a WebServer is at
https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/39325

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data