From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org)
	by nuthatch.gentoo.org with esmtp (Exim 4.60)
	(envelope-from <gentoo-user+bounces-48331-garchives=archives.gentoo.org@gentoo.org>)
	id 1GBfQs-00056z-Bo
	for garchives@archives.gentoo.org; Fri, 11 Aug 2006 22:24:46 +0000
Received: from robin.gentoo.org (localhost [127.0.0.1])
	by robin.gentoo.org (8.13.7/8.13.6) with SMTP id k7BMMVA9031635;
	Fri, 11 Aug 2006 22:22:31 GMT
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.190])
	by robin.gentoo.org (8.13.7/8.13.6) with ESMTP id k7BMKSMo011650
	for <gentoo-user@lists.gentoo.org>; Fri, 11 Aug 2006 22:20:28 GMT
Received: by nf-out-0910.google.com with SMTP id a25so1094315nfc
        for <gentoo-user@lists.gentoo.org>; Fri, 11 Aug 2006 15:20:28 -0700 (PDT)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=Li+jx/nWtbB/6dNF1AA4k+uaO9Per8bNA4FuqDM2+yHGV+gyl6qymvxvTLuDL0ly2GKSjB2gjOwtoJVvyevTOtM58WMYxnqUJLxR/khSRHfGO66yMzJf2Z/m1aZJqVOCu1QNd5Rkob0Su81uO2mQaaalXkxcezvSTVM4oqQtJ1o=
Received: by 10.78.165.16 with SMTP id n16mr2384703hue;
        Fri, 11 Aug 2006 15:20:28 -0700 (PDT)
Received: by 10.78.16.17 with HTTP; Fri, 11 Aug 2006 15:20:27 -0700 (PDT)
Message-ID: <7573e9640608111520g7e6e878hb048e5b1776fd281@mail.gmail.com>
Date: Fri, 11 Aug 2006 15:20:27 -0700
From: "Richard Fish" <bigfish@asmallpond.org>
Sender: richard.j.fish@gmail.com
To: gentoo-user@lists.gentoo.org
Subject: Re: [gentoo-user] Re: OT: iptables mac filtering
In-Reply-To: <loom.20060811T230121-160@post.gmane.org>
Precedence: bulk
List-Post: <mailto:gentoo-user@lists.gentoo.org>
List-Help: <mailto:gentoo-user+help@gentoo.org>
List-Unsubscribe: <mailto:gentoo-user+unsubscribe@gentoo.org>
List-Subscribe: <mailto:gentoo-user+subscribe@gentoo.org>
List-Id: Gentoo Linux mail <gentoo-user.gentoo.org>
X-BeenThere: gentoo-user@gentoo.org
Reply-to: gentoo-user@lists.gentoo.org
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <loom.20060809T191535-468@post.gmane.org>
	 <20060809214353.5787529e.hilse@web.de>
	 <loom.20060811T003230-539@post.gmane.org>
	 <7573e9640608110024gf773d0dxa8ef9f1da0a9f73f@mail.gmail.com>
	 <loom.20060811T230121-160@post.gmane.org>
X-Google-Sender-Auth: 00e0b56085df4120
X-Archives-Salt: 722e6006-d80b-4a6e-849a-ed097d4b1e01
X-Archives-Hash: d7dd291c729e2875f8210874a1bba5d2

On 8/11/06, James <wireless@tampabay.rr.com> wrote:
> myIP hackIP    TCP   55634 > smtp  (SYN) Seq=0 ACK=1 WIN=0 LEN=0
> hackIP   myIP  TCP   smtp > 55634 (RST,ACK) Seq=0 ACK=1 WIN=0 LEN=0 MSS=1460

Assuming you haven't mixed up the myIP and hackIP parts, this means
something on *your* system/network is trying to contact an smtp server
on what you are calling hackIP.  TCP/IP connections are initiated with
a SYN packet.  If they are accepted, you get a SYN,ACK packet back.
If they are rejected, you get a RST,ACK back.

Running 'host <hackIP>' might prove enlightening.

-Richard
-- 
gentoo-user@gentoo.org mailing list