Source & destination mac address in logs?

Hi Louis,

If you have Anti-DoS enable for UDP packets, you can discover these drops if there is a heavy UDP flood going around, it will also depend on the packet per second ratio which is set in Anti-DoS options. I guess the MAC address is over UTM's interface, again a wild guess as I don't know the present configurations on UTM.

Thanks

Hi Louis,

If you have Anti-DoS enable for UDP packets, you can discover these drops if there is a heavy UDP flood going around, it will also depend on the packet per second ratio which is set in Anti-DoS options. I guess the MAC address is over UTM's interface, again a wild guess as I don't know the present configurations on UTM.

Thanks

All in different locations ie towns about 60 miles apart from each other and using the same source port within seconds of each other? I find that really strange.

Louis, that is the MAC of the ISP's last hop router in front of your UTM. (BrucekConverget taught me that years ago.)

Cheers - Bob

HI Bob,

the strange thing is the ip addresses and the port numbers. The source ip's are 60 miles apart (172.31.xxx.yyy)
xxx is our subnets and I know exactly where they are and to also transmit on the same dynamic port at the same time? It's strange.