On Tue, 3 Jul 2001, Laurie Brown wrote:
Look for DPT= to see what they were after. Y0u have:
111 (Sun RPC) 53 (DNS) 21 (FTP) 211 (Texas Instruments 914C/G Terminal) [whatever that is]
Depending on the source IP (SRC=xx.xx.xx.xx) they may or may not be malicious. I suspect the latter, myself.
You snipped the flags section Laurie! as the only flags set are SYN they are trying to get you to do a SYN,ACK and then they know the port is open. If you see the RST (reset) flag then it is usually the connection has gone a bit pear shaped and is being renegotiated.
What I should of made very clear in my earlier message is that these 'error messages' are a good thing they show that your firewall is working and telling you of who has tried to connect to your machine on firewalled ports.
Adam