<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
<font size="2"><b>---------- Original Message
-----------</b>
<br />
From: webmaster <webmaster@oldcabin.net>
<br />
To: BlueOnyx General Mailing List <blueonyx@mail.blueonyx.it>
<br />
Sent: Thu, 20 Jul 2017 13:16:42 -0500
<br />
Subject: [BlueOnyx:21206] happening
<br />
<br />>
Getting the snip below
<br />>
<br />>
69.8.136.185 is the machine that I am tailing on
<br />>
<br />>
anyone know what's going on here?
<br />>
<br />>
I have seen this before from OTHER machines hitting this machine but
<br />>
never from the machine back to the same machine
<br />>
<br />>
-- snip ---
<br />>
<br />>
Jul 20 13:16:16 cabin3 kernel: IN=lo OUT=
<br />>
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=69.8.136.185
<br />>
DST=69.8.136.240 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=12141 DF PROTO=TCP
<br />>
SPT=50256 DPT=80 WINDOW=43690 RES=0x00 SYN URGP=0
<br />>
Jul 20 13:16:17 cabin3 kernel: IN=lo OUT=
<br />>
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=69.8.136.185
<br />>
DST=69.8.136.240 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=27166 DF PROTO=TCP
<br />>
SPT=50250 DPT=80 WINDOW=43690 RES=0x00 SYN URGP=0
<br />>
Jul 20 13:16:19 cabin3 kernel: IN=lo OUT=
<br />>
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=69.8.136.185
<br />>
DST=69.8.136.240 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=65374 DF PROTO=TCP
<br />>
SPT=50260 DPT=80 WINDOW=43690 RES=0x00 SYN URGP=0
<br />>
Jul 20 13:16:19 cabin3 kernel: IN=lo OUT=
<br />>
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=69.8.136.185
<br />>
DST=69.8.136.240 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=61313 DF PROTO=TCP
<br />>
SPT=50252 DPT=80 WINDOW=43690 RES=0x00 SYN URGP=0
<br />>
Jul 20 13:16:20 cabin3 kernel: IN=lo OUT=
<br />>
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=69.8.136.185
<br />>
DST=69.8.136.240 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=65375 DF PROTO=TCP
<br />>
SPT=50260 DPT=80 WINDOW=43690 RES=0x00 SYN URGP=0
<br />>
Jul 20 13:16:21 cabin3 kernel: IN=lo OUT=
<br />>
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=69.8.136.185
<br />>
DST=69.8.136.240 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=65315 DF PROTO=TCP
<br />>
SPT=50262 DPT=80 WINDOW=43690 RES=0x00 SYN URGP=0
<br />>
Jul 20 13:16:22 cabin3 kernel: IN=lo OUT=
<br />>
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=69.8.136.185
<br />>
DST=69.8.136.240 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=65316 DF PROTO=TCP
<br />>
SPT=50262 DPT=80 WINDOW=43690 RES=0x00 SYN URGP=0
<br />>
Jul 20 13:16:22 cabin3 kernel: IN=lo OUT=
<br />>
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=69.8.136.185
<br />>
DST=69.8.136.240 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=65376 DF PROTO=TCP
<br />>
SPT=50260 DPT=80 WINDOW=43690 RES=0x00 SYN URGP=0
<br />>
<br />>
Causing some real grief here
<br />>
<br />>
H e l p !?
<br />>
<br />>
* If it helps we has some bad storms her last night and the machine
<br />>
above me was having issues
<br />>
<br />>
Thanks
<br />>
<br />>
--Tim
<br /></font>
<br />Hi Tim.
<br />
<br />Your IPTables firewall software is stopping connections to your server, and logging the fact.
<br />
<br />The fields are DATE, TIME, SYSTEM NAME, WHAT'S DOING THE LOGGING (kernel), INTERFACE ITS COMING INTO THE SERVER OR OUT, MAC ADDRESS (can usually be ignored, as its usually your own router), SOURCE IP (<i><b>this</b></i> is the important piece), DESTINATION IP, PACKET LENGTH, TYPE OF SERVICE, TIME TO LIVE, FRAGMENTION BIT, PROTOCOL, SOURCE PORT, DESTINATION PORT, WINDOW NUMBER, TCP PROTOCOL FLAGS, TYPE OF PACKET (sync packet), and URGENT POINTER.
<br />
<br />The only ones you really need to worry about most of the time are Date, Time, Source IP, Destination IP (if you have more than one on your server), and Destination Port. These will tell you who is hitting your server with what type of service request, and how often. Remembering of course - all these packets were blocked! That's why they're logged in the first place!
<br />
<br />Once you learn to read IPTables firewall logs, you can customize your IPTables firewall rules - to block just what you'd like, while still allowing valid user traffic through.
<br />
<br />In the above, it appears someone at IP 69.8.136.185 was trying to hit your server at 69.8.136.240 on TCP Port 80 (web traffic). But since these packets were logged - its a pretty good bet your IPTables stopped them (you can log without stopping, but why?? - so its usually logging a blocked packet). So that machine at 69.8.136.185 was stopped from reaching a webpage on your server. Why? Good question. I'm not sure why you'd ever want to block port 80.
<br />
<br />If you want help removing the block - grab a copy of your firewall rules and post it here. Use "iptables -L -n". We can look for the rule causing the block and help you remove it.
<br />
<br />
<br />Chuck
<br />
<br />
<br />
</BODY>
</HTML>