How to block "No Foreign Address" connections?

[Tom Dawson]

Hi,

Below you will see a partial output from a netstat command. Note the Foreign Addresses that show only a port number. We've determined that these come from Winblows 2000 PCs that have turned off the Message Service. This is done so the user doesn't get a message box everytime she prints.

Is there a way ( maybe through /var/adm/inetd.sec ) to block connections from PCs that are not advertising their IP address?

Thanks,
Tom
----------------------------------------
Active Internet connections
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp 0 0 flo1q07.ora1526 .1599 ESTABLISHED
tcp 0 0 localhost.49194 localhost.49284 ESTABLISHED
tcp 0 0 flo1q07.telnet tdawsond.eptnet.com.3596 ESTABLISHED
tcp 0 0 flo1q07.ora1526 flo1a03.eptnet.com.1058 ESTABLISHED
tcp 0 0 localhost.49286 localhost.49194 ESTABLISHED
tcp 0 0 localhost.49284 localhost.49194 ESTABLISHED
tcp 0 0 flo1q07.ora1526 .1663 ESTABLISHED
tcp 0 0 flo1q07.ora1526 .1673 ESTABLISHED
tcp 0 0 flo1q07.ora1526 .1601 ESTABLISHED
tcp 0 0 flo1q07.ora1526 .1604 ESTABLISHED
tcp 0 0 localhost.49288 localhost.49194 ESTABLISHED
tcp 0 0 flo1q07.1748 flo1a03.eptnet.com.4295 ESTABLISHED
tcp 0 0 flo1q07.49214 flo1q07.ora1526 ESTABLISHED
tcp 0 0 flo1q07.ora1526 flo1q07.49214 ESTABLISHED
tcp 0 0 flo1q07.ora1526 flo1q07.49213 ESTABLISHED

[Wodisch · Accepted solution]

Hi Tom,

how about installing IPFilter/9000 (free) and use the firewall features to do that?

Just an idea,
Wodisch

[Tom Dawson]

Wodisch,

Thanks! And it's probably not a bad idea at that! I was trying to see if I could accomplish it with software already on the system.


Tom

[harry d brown jr]

Tom,

It's not possible for a PC to connect to anything on a IP NETWORK without an IP address.

Get lsof, as netstat bites!

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.64/

and of course you should be running netstat like this:

netstat -an


They'll show up!

live free or die
harry