Differents IP in the firewall log that the original IP

[mª del Carmen_1]

Hi all
I'm working in a HP UX N4000 B.11.00 U 9000/800 server. I have DNS. When I try to print from this server to a printer what is in other net, y launch:
lp -d -onb /tmp/kk.txt
I don't have any problem in the screen but I see in the log of firewall that there is a call to 4 differents IP, not to the printer IP.
I can see the correct printer IP with the nslookup command.

Is there anyone who knows why these others IP appear or who could help me with any network test or log file?

Thanks in advance

[Sanjay_6]

Hi,

Do a traceroute to the printer ip / dns name and check the output.

Is there some sort of Network Address Translation (NAT) that is being done on the firewall.

Check with your network folks.

Hope this helps.

Regds

[A. Clay Stephenson]

This could be NAT (Network Address Translation). The NAT'ing could be occurring in the firewall itself (or another firewall) or in routers. You have to look at your NAT tables.

[Sanjay_6]

Hi,

If possible, ask your network folks to setup a sniffer to look at the traffic between there two ip (server & printer). They should be able to filter the traffic only between these ip and may be able to give you a better explanation.

Hope this helps.

Regds

[mª del Carmen_1]

Thanks, but we don't have NAT.

[Ron Kinner]

When you use the printer_name and it is not in your /etc/hosts file then it need to do a DNS lookup for the ip address. That might account for some of the traffic you are seeing.

Ron

[Biswajit Tripathy]

Few questions:

1) Is the firewall IPFilter or some other firewall?
2) You said the firewall logs calls to 4 different IPs.
What are the src/dst port number these logs?
3) Also, does these 4 IP addresses are existing
machines on your network?

Better still, post the firewall logs here.
- Biswajit

[Cheryl Griffin]

You can reward the many people who have assisted you by assigning points to their posts.

For steps how to assign points see:
http://forums1.itrc.hp.com/service/forums/helptips.do?#33

[mª del Carmen_1]

Thanks all for your help and excuse me for the delay. It has not been possible for me replay before.
The differents IP in the firewall log are the IP of others printer (maybe registered in the /var/spool/lp/pstatus, but I don't why they appear there.

Thanks

[mª del Carmen_1]

Thanks all again