Re: [FW-1] drop, icmp, rule 0 from broadcast? HELP!

["Reed Mohn, Anders" <Anders.Reed.Mohn@FW1-NOSPAMITCOMPAGNIET.NO>]

Uhh.  aren't "Service", and "Dest. port" meaningless for ICMP?

Anyway, setting up a rule to drop these packets
is not going to solve the problem, just hide it.

I'd get out a packet sniffer, and try to trace down
the source ASAP.

The "allow broadcasts"-setting only specifies whether
the broadcast address is regarded as a valid
IP-address for that particular network.
In other words, if it's on (allowed), any packets to/from it
will be allowed, and must be stopped by other rules.
If it's off, they will be stopped (by anti-spoofing checks, I guess).
In any case, you're gonna see the packets in the logs.

Cheers,
Anders :)


> -----Original Message-----
> From: Yanek Korff [mailto:yanek@CIGITAL.COM]
> Sent: 21. desember 2001 19:44
> To: FW-1-MAILINGLIST@beethoven.us.checkpoint.com
> Subject: [FW-1] drop, icmp, rule 0 from broadcast? HELP!
>
>
> I have a FW in place, not yet in production, and it's
> CONSTANTLY loggging
> these drops:
>
> Interface: internal interface
> Type: log
> Action: drop
> Service: hiport (>1024)
> Source: 10.1.255.255
> Destination: Various internal 10.1.x.x hosts
> Proto: icmp
> Rule: 0
> S_Port: 771
>
> And I can't get them to stop logging.  What are these, and
> how do I get rid
> of them?  They're really filling up my FW logs.
>
> I've tried setting the network object "LAN" (10.1.0.0/255.255.0.0) to
> disallow broadcast... and allow broadcast... both to no avail.
>
> -Yanek.
>
> =================================================
> To set vacation, Out Of Office, or away messages,
> send an email to LISTSERV@lists.us.checkpoint.com
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> fw-1-owner@ts.checkpoint.com
> =================================================
>

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================