Frage wg. Inhalt vom Protokoll

[blob]

In der letzten Zeit sehe ich öfter im Protokoll von iptraf:
/ Absuchen aller ports nach UDP
/ Dauerndes Kontaktieren und Übertragen von Daten stns. eines mailX.rootly.com

Was bedeutet das denn ??

Ferner kommen Meldungen ICMP dist unrch (port) ... from localhost to localhost on lo

Fri Aug  3 13:51:08 2007; UDP; eth0; 81 bytes; from werner.localnet.lan:43916 to dns-adsl-gpe2-a.wanadoo.fr:domain
Fri Aug  3 13:51:09 2007; UDP; eth0; 156 bytes; from dns-adsl-gpe2-a.wanadoo.fr:domain to werner.localnet.lan:43916
Fri Aug  3 13:51:09 2007; TCP; eth0; 44 bytes; from werner.localnet.lan:56100 to mail3.rootly.com:http; first packet (SYN)
Fri Aug  3 13:51:09 2007; TCP; eth0; 46 bytes; from mail3.rootly.com:http to werner.localnet.lan:56100; first packet (SYN)
Fri Aug  3 13:51:09 2007; TCP; eth0; 46 bytes; from mail3.rootly.com:http to werner.localnet.lan:56100; FIN sent; 3 packets, 138 bytes, avg flow rate 1.00 kbits/s
Fri Aug  3 13:51:09 2007; TCP; eth0; 40 bytes; from werner.localnet.lan:56100 to mail3.rootly.com:http; FIN acknowleged
Fri Aug  3 13:51:09 2007; TCP; eth0; 40 bytes; from werner.localnet.lan:56100 to mail3.rootly.com:http; FIN sent; 6 packets, 1035 bytes, avg flow rate 8.00 kbits/s
Fri Aug  3 13:51:10 2007; TCP; eth0; 46 bytes; from mail3.rootly.com:http to werner.localnet.lan:56100; FIN acknowleged
Fri Aug  3 13:51:14 2007; UDP; eth0; 60 bytes; from werner.localnet.lan:43916 to dns-adsl-gpe2-a.wanadoo.fr:domain
Fri Aug  3 13:51:14 2007; UDP; eth0; 60 bytes; from werner.localnet.lan:43917 to dns-adsl-gpe2-a.wanadoo.fr:domain
Fri Aug  3 13:51:14 2007; UDP; eth0; 92 bytes; from dns-adsl-gpe2-a.wanadoo.fr:domain to werner.localnet.lan:43916
Fri Aug  3 13:51:14 2007; UDP; eth0; 111 bytes; from dns-adsl-gpe2-a.wanadoo.fr:domain to werner.localnet.lan:43917
Fri Aug  3 13:51:14 2007; UDP; eth0; 81 bytes; from werner.localnet.lan:43918 to dns-adsl-gpe2-a.wanadoo.fr:domain
Fri Aug  3 13:51:15 2007; UDP; eth0; 156 bytes; from dns-adsl-gpe2-a.wanadoo.fr:domain to werner.localnet.lan:43918
Fri Aug  3 13:51:15 2007; TCP; eth0; 44 bytes; from werner.localnet.lan:43395 to mail2.rootly.com:http; first packet (SYN)
Fri Aug  3 13:51:15 2007; TCP; eth0; 46 bytes; from mail2.rootly.com:http to werner.localnet.lan:43395; first packet (SYN)
Fri Aug  3 13:51:15 2007; TCP; eth0; 46 bytes; from mail2.rootly.com:http to werner.localnet.lan:43395; FIN sent; 4 packets, 866 bytes, avg flow rate 6.00 kbits/s
Fri Aug  3 13:51:15 2007; TCP; eth0; 40 bytes; from werner.localnet.lan:43395 to mail2.rootly.com:http; FIN acknowleged
Fri Aug  3 13:51:15 2007; TCP; eth0; 40 bytes; from werner.localnet.lan:43395 to mail2.rootly.com:http; FIN sent; 5 packets, 988 bytes, avg flow rate 7.00 kbits/s
Fri Aug  3 13:51:16 2007; TCP; eth0; 46 bytes; from mail2.rootly.com:http to werner.localnet.lan:43395; FIN acknowleged
Fri Aug  3 13:51:17 2007; UDP; eth0; 60 bytes; from werner.localnet.lan:43918 to dns-adsl-gpe2-a.wanadoo.fr:domain
Fri Aug  3 13:51:17 2007; UDP; eth0; 60 bytes; from werner.localnet.lan:43919 to dns-adsl-gpe2-a.wanadoo.fr:domain
Fri Aug  3 13:51:17 2007; UDP; eth0; 92 bytes; from dns-adsl-gpe2-a.wanadoo.fr:domain to werner.localnet.lan:43918
Fri Aug  3 13:51:17 2007; UDP; eth0; 111 bytes; from dns-adsl-gpe2-a.wanadoo.fr:domain to werner.localnet.lan:43919

 

[Huschi]

Gegenfrage:
Was hat das mit Webserver zu tun?

-- Verschoben nach Security --

huschi.