Community Forums
Connect with us on LinkedIn
+ Reply to Thread
Results 1 to 3 of 3
  1. #1
    Member
    Join Date
    Nov 2002
    Posts
    430

    Default What does this mean - logwatch - Dropped 981 packets on interface eth0..?

    Logwatch for one server is reporting this:

    --------------------- Kernel Begin ------------------------

    Dropped 981 packets on interface eth0
    From 12.5.235.98 - 2 packets
    To 63.247.83.203 - 1 packet
    Service: 37852 (udp/37852) (**UDP DROP**,eth0,none) - 1 packet
    To 209.51.152.138 - 1 packet
    Service: 37852 (udp/37852) (**UDP DROP**,eth0,none) - 1 packet
    From 15.227.128.20 - 2 packets
    To 209.51.152.138 - 2 packets
    Service: 59743 (udp/59743) (**UDP DROP**,eth0,none) - 2 packets
    From 15.243.160.20 - 4 packets
    To 209.51.152.138 - 4 packets
    Service: 59743 (udp/59743) (**UDP DROP**,eth0,none) - 4 packets
    From 32.97.27.254 - 3 packets
    To 209.51.152.138 - 3 packets
    Service: 5120 (tcp/5120) (**TCP DROP**,eth0,none) - 3 packets
    From 61.6.32.154 - 2 packets
    To 209.51.152.138 - 2 packets
    Service: auth (tcp/113) (**TCP DROP**,eth0,none) - 2 packets
    From 61.43.122.223 - 2 packets
    To 63.247.83.251 - 2 packets
    Service: microsoft-ds (tcp/445) (**TCP DROP**,eth0,none) - 2 packets
    From 61.48.16.148 - 5 packets
    To 63.247.83.193 - 1 packet
    Service: rtsp (tcp/554) (**TCP DROP**,eth0,none) - 1 packet
    To 63.247.83.199 - 1 packet
    Service: rtsp (tcp/554) (**TCP DROP**,eth0,none) - 1 packet
    To 63.247.83.205 - 1 packet
    .
    .
    etc..


    I can see that some packets are lost, but are there any reason to be concerned?

    Thanks
    John Norgaard
    ebizalive.net

  2. #2
    Member casey's Avatar
    Join Date
    Jan 2003
    Location
    If there is trouble, it will find me
    Posts
    2,336

    Default

    I'm getting tons of those, too.

  3. #3
    Member casey's Avatar
    Join Date
    Jan 2003
    Location
    If there is trouble, it will find me
    Posts
    2,336

    Default

    Originally posted by thaphantom
    most likely you are under a syn attack:

    http://faq.cpanel.net/show.cgi?qa=104700513408268
    Nope, not me. Interesting link though, thanks.

Similar Threads & Tags
Similar threads

  1. 3899 packets dropped by kernel - Cant view any sites
    By BianchiDude in forum cPanel and WHM Discussions
    Replies: 0
    Last Post: 11-17-2005, 11:22 AM
  2. APF + interface eth0 is routed to a network
    By vinc_dc43 in forum cPanel and WHM Discussions
    Replies: 1
    Last Post: 11-07-2005, 02:18 PM
  3. Confused about outgoing packets being dropped by APF
    By damainman in forum cPanel and WHM Discussions
    Replies: 6
    Last Post: 01-25-2005, 11:04 AM
  4. 2 interface (eth0 and eth1)??
    By odesia in forum New User Questions
    Replies: 1
    Last Post: 06-30-2004, 04:06 PM
  5. Can't access user/admin interface. Is it eth0? Bad install?
    By jcf in forum cPanel and WHM Discussions
    Replies: 0
    Last Post: 04-01-2004, 02:37 PM
Linkedin       Facebook       Twitter       RSS       Flickr       YouTube