/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting!
/* ALSO: Don't quote this header. It makes you look lame :-) */
Hi!
One (lame) possibility is to insert a rule that will reject those packets
without logging them just before the rule that is generating all this
noise. I would go for:
"/sbin/ipchains -I input 66 -p udp -d 192.168.2.255 137 -j REJECT" and then
repeat that for port 138 and for the 192.168.1 network.
Peace,
Joao
"Ashley M. Kirchner" wrote:
> /* HINT: Search archives @ http://www.indyramp.com/masq/ before posting!
> /* ALSO: Don't quote this header. It makes you look lame :-) */
>
> Frigging NT machines....
>
> Ok, my internal device is configured for 10.2.x.x, yet I'm getting a
> ton of (rejected) SMB traffic on that device from ONE host that's
> connected to that HUB. That host is an NT machine that happens to have
> it's two network cards configured for 192.168.1.x and 192.168.2.x (why?
> who the heck knows...)
>
> So, consequently, I'm getting these messages in my log file:
>
> kernel: Packet log: input REJECT eth1 PROTO=17 192.168.2.x:137
> 192.168.2.255:137 L=78 S=0x00 I=32426 F=0x0000 T=128 (#66)
> kernel: Packet log: input REJECT eth1 PROTO=17 192.168.2.x:138
> 192.168.2.255:138 L=78 S=0x00 I=32426 F=0x0000 T=128 (#66)
>
> kernel: Packet log: input REJECT eth1 PROTO=17 192.168.1.x:137
> 192.168.1.255:137 L=235 S=0x00 I=16643 F=0x0000 T=128 (#66)
> kernel: Packet log: input REJECT eth1 PROTO=17 192.168.1.x:138
> 192.168.1.255:138 L=235 S=0x00 I=16643 F=0x0000 T=128 (#66)
>
> (NOTE: eth1 is configured for 10.2.x.x - NOT 192.168.x.x)
>
> I frankly don't care that the NT server is broadcasting crap. What
> I'd like to do is silently reject them (no logging). Can anyone help me
> with the ipchains rule here?
>
> AMK4
>
> --
> W |
> | Digital information lasts forever, or five years
> | - whichever comes first.
> |____________________________________________________________________
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Ashley M. Kirchner <mailto:[EMAIL PROTECTED]> . 303.442.6410 x130
> SysAdmin / Websmith . 800.441.3873 x130
> Photo Craft Laboratories, Inc. . eFax 248.671.0909
> http://www.pcraft.com . 3550 Arapahoe Ave
> .................. . . . . Boulder, CO 80303
>
> _______________________________________________
> Masq maillist - [EMAIL PROTECTED]
> Admin requests can be handled at http://www.indyramp.com/masq-list/ --
> THIS INCLUDES UNSUBSCRIBING!
> or email to [EMAIL PROTECTED]
>
> PLEASE read the HOWTO and search the archives before posting.
> You can start your search at http://www.indyramp.com/masq/
> Please keep general linux/unix/pc/internet questions off the list.
--
-----------------------------------------------------------------
Fabrica de Ideias
sbs - ed. empire center - sala 109 - cep 70070-904 - brasilia-df
tel: (61) 321 1357
fax: (61) 321 6096
[EMAIL PROTECTED]
-----------------------------------------------------------------
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ --
THIS INCLUDES UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
