1. Home
  2. Networking Firewalls
  3. strange packets from 192.168.1.126

strange packets from 192.168.1.126

Dear all,

I've recently noticed some packets coming in on port 22 (sshd) on my external interface from the 192.168.1.0/24 network. I don't have any local machines on this network and the packets are coming in on my WAN interface (via my router). How is that possible? My understanding was that this network was not routeable from the internet. I'm guessing someone is try to get at my sshd server. Below are the packets. Is there any way to get more info on where they are coming from?

Feb 20 20:02:14 tti kernel: iptables chain hostile: IN=eth1 OUT= MAC=00:0e:0c:dd:73:16:00:11:6e:00:f9:70:08:00 SRC=192.168.1.126 DST=172.16.251.61 LEN=228 TOS=0x10 PREC=0x00 TTL=47 ID=19109 DF PROTO=TCP SPT=38196 DPT=22 WINDOW=16022 RES=0x00 ACK PSH FIN URGP=0

I'm using iptables on a 2.6 Linux box.

Kevin

Reply to
Kevin VW
Loading thread data ...

It might still be routable within your ISP's backbone.

It might also have changed its IP address due to reassembly of overlapping IP fragments.

Reply to
Sebastian G.

"Sebastian G." wrote in news: snipped-for-privacy@mid.dfncis.de:

Kevin,

Yes, I concur with Mr. G. Reassembly of overlapping IP packets is the most likely cause.

Reply to
BlinkyBee

Kevin, I saw such stuff once in my firewall *incoming* as well and I think an IP pkg with such private range src addr may arrive if the dst addr is correct, but of course no answer through Internet to that src addr is possible.

matthias

Reply to
Matthias Apitz

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.