Re: [gentoo-user] Strange outbound requests

[Grant]

>>>> I'm still getting the blocked outbound requests to port 3680 on my
>>>> firewall and I'm running the above script (changed 993 to 3680) on the
>>>> local system indicated by SRC in the firewall log, but mystery.log
>>>> remains empty.  I tested the script with other ports and it seems to
>>>> be working fine.
>>>>
>>>> Also the MAC indicated in the firewall log is 14 blocks long and the
>>>> local system in question has a MAC address 6 blocks long according to
>>>> ifconfig, but the 6 blocks from ifconfig do match 6 of the blocks
>>>> reported by the firewall.
>>>>
>>>> Does this make sense to anyone?
>>>
>>> Does not make sense to me, sorry.  :-(
>>
>> Since my local firewall is rejecting the outbound requests, the time
>> elapsed between the request and the block should be very short.  Is it
>> possible the 'sleep 1' portion of the script is causing the failure to
>> log the connection request?  The outbound connection is only attempted
>> a few times per day.  If so, how would you recommend fixing that?
>
> Try configuring your local firewall to log the request. There may be
> something useful, such as logging an associated PID or user, that you
> can add there. I don't know.
>
> Alternately, you could DROP the outbound packet rather than REJECT it;
> that should cause the connecting process to wait several seconds until
> it times out.

I've just done this at your's and Michael Orlitzky's suggestion.
Waiting for another connection attempt now.

>> I'm also wondering if there is a command I could run on the
>> router/firewall machine that would log something from the outbound
>> request.  Even if the information logged isn't useful, it would be
>> nice to see a confirmation of the outbound requests logged from
>> somewhere besides the firewall.
>
> Ow. We need to get a bit more specific. Is the 'local firewall' on the
> connecting host, or is it on your router?

The firewall runs on the router (which is a Gentoo system) in the local network.

> As far as logging goes, you can set up a rule (prior to your DROP or
> REJECT) with a target of LOG. The packet will show up in syslog.

I just started running this on the router:

tcpdump -i eth1 -n | grep the.offending.ip.address

where eth1 is my LAN interface.  I figure this will tell me if any
requests are being made to the offending IP, including any that aren't
being logged by the firewall.  Nothing yet.

- Grant