/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting!
/* ALSO: Don't quote this header. It makes you look lame :-) */
The easiest and most effective way to fix this problem in its entirety is to
do the following (NOTE: This does call for a little bit of physical work,
but it is well worth it due to the pleasure factor):
1) Find the NT box.
2) Reach your hand out towards the power plug, and unplug it.
3) Kick the NT box.
4) Walk away.
It might help to repeat step 3 a few times; that usually helps ensure things
stay fixed.
IP Chains will only get you so far...
----- Original Message -----
From: "Joao Neves" <[EMAIL PROTECTED]>
To: "Ashley M. Kirchner" <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Tuesday, June 20, 2000 5:22 PM
Subject: Re: [Masq] SMB flood
> /* HINT: Search archives @ http://www.indyramp.com/masq/ before posting!
> /* ALSO: Don't quote this header. It makes you look lame :-) */
>
>
> Hi!
>
> One (lame) possibility is to insert a rule that will reject those packets
> without logging them just before the rule that is generating all this
> noise. I would go for:
> "/sbin/ipchains -I input 66 -p udp -d 192.168.2.255 137 -j REJECT" and
then
> repeat that for port 138 and for the 192.168.1 network.
>
> Peace,
> Joao
>
> "Ashley M. Kirchner" wrote:
>
> > /* HINT: Search archives @ http://www.indyramp.com/masq/ before posting!
> > /* ALSO: Don't quote this header. It makes you look lame :-) */
> >
> > Frigging NT machines....
> >
> > Ok, my internal device is configured for 10.2.x.x, yet I'm getting a
> > ton of (rejected) SMB traffic on that device from ONE host that's
> > connected to that HUB. That host is an NT machine that happens to have
> > it's two network cards configured for 192.168.1.x and 192.168.2.x (why?
> > who the heck knows...)
> >
> > So, consequently, I'm getting these messages in my log file:
> >
> > kernel: Packet log: input REJECT eth1 PROTO=17 192.168.2.x:137
> > 192.168.2.255:137 L=78 S=0x00 I=32426 F=0x0000 T=128 (#66)
> > kernel: Packet log: input REJECT eth1 PROTO=17 192.168.2.x:138
> > 192.168.2.255:138 L=78 S=0x00 I=32426 F=0x0000 T=128 (#66)
> >
> > kernel: Packet log: input REJECT eth1 PROTO=17 192.168.1.x:137
> > 192.168.1.255:137 L=235 S=0x00 I=16643 F=0x0000 T=128 (#66)
> > kernel: Packet log: input REJECT eth1 PROTO=17 192.168.1.x:138
> > 192.168.1.255:138 L=235 S=0x00 I=16643 F=0x0000 T=128 (#66)
> >
> > (NOTE: eth1 is configured for 10.2.x.x - NOT 192.168.x.x)
> >
> > I frankly don't care that the NT server is broadcasting crap. What
> > I'd like to do is silently reject them (no logging). Can anyone help me
> > with the ipchains rule here?
> >
> > AMK4
> >
> > --
> > W |
> > | Digital information lasts forever, or five years
> > | - whichever comes first.
> > |____________________________________________________________________
> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > Ashley M. Kirchner <mailto:[EMAIL PROTECTED]> . 303.442.6410 x130
> > SysAdmin / Websmith . 800.441.3873 x130
> > Photo Craft Laboratories, Inc. . eFax 248.671.0909
> > http://www.pcraft.com . 3550 Arapahoe Ave
> > .................. . . . . Boulder, CO 80303
> >
> > _______________________________________________
> > Masq maillist - [EMAIL PROTECTED]
> > Admin requests can be handled at http://www.indyramp.com/masq-list/ --
> > THIS INCLUDES UNSUBSCRIBING!
> > or email to [EMAIL PROTECTED]
> >
> > PLEASE read the HOWTO and search the archives before posting.
> > You can start your search at http://www.indyramp.com/masq/
> > Please keep general linux/unix/pc/internet questions off the list.
>
> --
> -----------------------------------------------------------------
> Fabrica de Ideias
> sbs - ed. empire center - sala 109 - cep 70070-904 - brasilia-df
> tel: (61) 321 1357
> fax: (61) 321 6096
> [EMAIL PROTECTED]
> -----------------------------------------------------------------
>
> _______________________________________________
> Masq maillist - [EMAIL PROTECTED]
> Admin requests can be handled at http://www.indyramp.com/masq-list/ --
> THIS INCLUDES UNSUBSCRIBING!
> or email to [EMAIL PROTECTED]
>
> PLEASE read the HOWTO and search the archives before posting.
> You can start your search at http://www.indyramp.com/masq/
> Please keep general linux/unix/pc/internet questions off the list.
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ --
THIS INCLUDES UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
