Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 3 subscribers
  • Views 8058 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Source & destination mac address in logs?

Louis-M

Can anybody explain what the source mac address & destination mac address relates to in the firewall logs?

The reason I ask is because of the logs below. The source IP addresses (3rd octet = 26, 11 & 27) are 60 miles apart from each other??

09:43:25

Default DROP

UDP

 

172.31.26.3

:

16403

→

17.155.127.222

:

16384

 

len=44

ttl=57

tos=0x00

srcmac=24:e9:b3:85:0d:c0

dstmac=00:1a:8c:f0:1d:a0

09:43:25

Default DROP

UDP

 

172.31.26.3

:

16403

→

17.155.127.222

:

16385

 

len=44

ttl=57

tos=0x00

srcmac=24:e9:b3:85:0d:c0

dstmac=00:1a:8c:f0:1d:a0

 

09:43:25

Default DROP

UDP

 

172.31.26.3

:

16403

→

17.155.127.223

:

16386

 

len=44

ttl=57

tos=0x00

srcmac=24:e9:b3:85:0d:c0

dstmac=00:1a:8c:f0:1d:a0

09:43:25

Default DROP

UDP

 

172.31.11.118

:

16403

→

17.155.127.222

:

16384

 

len=44

ttl=58

tos=0x00

srcmac=24:e9:b3:85:0d:c0

dstmac=00:1a:8c:f0:1d:a0

 

09:43:25

Default DROP

UDP

 

172.31.11.118

:

16403

→

17.155.127.222

:

16385

 

len=44

ttl=58

tos=0x00

srcmac=24:e9:b3:85:0d:c0

dstmac=00:1a:8c:f0:1d:a0

09:43:25

Default DROP

UDP

 

172.31.11.118

:

16403

→

17.155.127.223

:

16386

 

len=44

ttl=58

tos=0x00

srcmac=24:e9:b3:85:0d:c0

dstmac=00:1a:8c:f0:1d:a0

 

09:43:25

Default DROP

UDP

 

172.31.27.37

:

16403

→

17.155.127.222

:

16384

 

len=44

ttl=61

tos=0x00

srcmac=24:e9:b3:85:0d:c0

dstmac=00:1a:8c:f0:1d:a0


This thread was automatically locked due to age.
Parents
  • 0

    Hi Louis,

    If you have Anti-DoS enable for UDP packets, you can discover these drops if there is a heavy UDP flood going around, it will also depend on the packet per second ratio which is set in Anti-DoS options. I guess the MAC address is over UTM's interface, again a wild guess as I don't know the present configurations on UTM.

    Thanks

  • 0 in reply to sachingurung

    172.31.26.3

    :

    16403   =  TOWN A

    172.31.11.211

    :

    16403   =  TOWN B

    172.31.27.34

    :

    16403   =  TOWN C

    All in different locations ie towns about 60 miles apart from each other and using the same source port within seconds of each other? I find that really strange.

  • 0 in reply to Louis-M

    Louis, that is the MAC of the ISP's last hop router in front of your UTM. (BrucekConverget taught me that years ago.)

    Cheers - Bob

  • 0 in reply to BAlfson

    HI Bob,

    the strange thing is the ip addresses and the port numbers. The source ip's are 60 miles apart (172.31.xxx.yyy)
    xxx is our subnets and I know exactly where they are and to also transmit on the same dynamic port at the same time? It's strange.

Reply
  • 0 in reply to BAlfson

    HI Bob,

    the strange thing is the ip addresses and the port numbers. The source ip's are 60 miles apart (172.31.xxx.yyy)
    xxx is our subnets and I know exactly where they are and to also transmit on the same dynamic port at the same time? It's strange.

Children
No Data