Internet Gateway DSL Verbindung wird gehalten

[Fred]

Unter Suse Linux 8.0 ist Installiert
named bind 9
Suse firewall2
squid
apache
DSL (t-online)
sendmail

Der Rechner dient als Gateway für ein kleines Netz. Funktioniert auch alles prima. Ich habe nur das Problem, daß die DSL Verbindung nur sehr selten abbricht, weil die Verbindung zu bestimmten Rechnern gehalten wird.

Entweder sehe ich den Wald vor lauter Bäumen nicht oder ???

Hier ein Auszug aus messages betreffs der Firewall Protokolle und die Ripe-Infos zu einigen Rechnern:


Mar 31 23:48:32 lilo kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=81.77.102.143 DST=217.232.10.213 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=25837 DF PROTO=TCP SPT=4074 DPT=1193 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Mar 31 23:49:58 lilo kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=219.102.49.134 DST=217.232.10.213 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=30570 DF PROTO=TCP SPT=39632 DPT=1193 WINDOW=5656 RES=0x00 SYN URGP=0 OPT (020405860402080A008BB0240000000001030300)
Mar 31 23:51:03 lilo kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=193.77.234.165 DST=217.232.10.213 LEN=78 TOS=0x00 PREC=0x00 TTL=119 ID=48073 PROTO=UDP SPT=54265 DPT=137 LEN=58
Mar 31 23:52:21 lilo kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=209.144.208.218 DST=217.232.10.213 LEN=48 TOS=0x00 PREC=0x00 TTL=115 ID=63796 DF PROTO=TCP SPT=4036 DPT=1193 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Mar 31 23:52:26 lilo kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=200.161.68.185 DST=217.232.10.213 LEN=78 TOS=0x00 PREC=0x00 TTL=114 ID=32217 PROTO=UDP SPT=1046 DPT=137 LEN=58
Mar 31 23:53:02 lilo kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=65.65.28.220 DST=217.232.10.213 LEN=78 TOS=0x00 PREC=0x00 TTL=116 ID=32718 PROTO=UDP SPT=1026 DPT=137 LEN=58
Mar 31 23:53:15 lilo kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=216.99.199.78 DST=217.232.10.213 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=32146 DF PROTO=TCP SPT=50015 DPT=1193 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B40402080A156128140000000001030300)
Mar 31 23:53:43 lilo kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=216.154.11.23 DST=217.232.10.213 LEN=78 TOS=0x00 PREC=0x00 TTL=113 ID=52522 PROTO=UDP SPT=1027 DPT=137 LEN=58
Mar 31 23:53:55 lilo kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=64.229.49.21 DST=217.232.10.213 LEN=78 TOS=0x00 PREC=0x00 TTL=116 ID=36148 PROTO=UDP SPT=34513 DPT=137 LEN=58
Mar 31 23:54:22 lilo kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=66.92.236.45 DST=217.232.10.213 LEN=48 TOS=0x00 PREC=0x00 TTL=113 ID=61916 DF PROTO=TCP SPT=13319 DPT=1193 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Mar 31 23:54:31 lilo kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=205.243.253.85 DST=217.232.10.213 LEN=78 TOS=0x00 PREC=0x00 TTL=115 ID=14325 PROTO=UDP SPT=1029 DPT=137 LEN=58
Mar 31 23:54:52 lilo kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=151.203.75.38 DST=217.232.10.213 LEN=78 TOS=0x00 PREC=0x00 TTL=116 ID=5343 PROTO=UDP SPT=1027 DPT=137 LEN=58
Mar 31 23:56:02 lilo kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=65.64.144.201 DST=217.232.10.213 LEN=78 TOS=0x00 PREC=0x00 TTL=114 ID=1630 PROTO=UDP SPT=1027 DPT=137 LEN=58
Mar 31 23:56:03 lilo kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=63.186.137.196 DST=217.232.10.213 LEN=78 TOS=0x00 PREC=0x00 TTL=119 ID=41853 PROTO=UDP SPT=1030 DPT=137 LEN=58
Mar 31 23:56:54 lilo kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=65.49.84.197 DST=217.232.10.213 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=26271 DF PROTO=TCP SPT=4982 DPT=1193 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A1D60EA6F0000000001030300)

inetnum: 81.77.0.0 - 81.77.127.255
netname: E2-DSL-1
descr: Energis UK
descr: DSL Customers
country: GB
admin-c: MADM1-RIPE
tech-c: MADM1-RIPE
status: ASSIGNED PA
mnt-by: ENERGIS-MNT
changed: abuse@energis.com 20020919
source: RIPE

route: 81.76.0.0/14
descr: Energis UK
origin: AS5388
mnt-by: ENERGIS-MNT
changed: denis@energis.com 20020307
changed: denis@energis.com 20020916
source: RIPE

role: Modem and DSL Team
address: Energis UK
address: Melbourne Street
address: Leeds, LS2 7PS
address: United Kingdom
phone: +44 113 2345100
e-mail: access@energis.com
admin-c: ENIT1-RIPE
tech-c: ENIT1-RIPE
nic-hdl: MADM1-RIPE
remarks: Abuse reports to abuse@energis.com please!
remarks: No actions are taken on abuse reports sent to modem team.
mnt-by: ENERGIS-MNT
changed: abuse@energis.com 20021127
source: RIPE

------------------------

inetnum: 219.96.0.0 - 219.127.255.255
netname: JPNIC-NET-JP
descr: Japan Network Information Center
country: JP
admin-c: JNIC1-AP
tech-c: JNIC1-AP
mnt-by: APNIC-HM
mnt-lower: MAINT-JPNIC
changed: hostmaster@apnic.net 20020307
status: ALLOCATED PORTABLE
source: APNIC

role: Japan Network Information Center
address: Kokusai-Kougyou-Kanda Bldg 6F, 2-3-4 Uchi-Kanda
address: Chiyoda-ku, Tokyo 101-0047, Japan
country: JP
phone: +81-3-5297-2311
fax-no: +81-3-5297-2312
e-mail: hostmaster@nic.ad.jp
admin-c: SN108-AP
tech-c: KS218-AP
nic-hdl: JNIC1-AP
mnt-by: MAINT-JPNIC
changed: apnic-ftp@nic.ad.jp 19990629
changed: hostmaster@apnic.net 20011011
changed: ip-staff@nic.ad.jp 20021018
source: APNIC

inetnum: 219.102.0.0 - 219.102.63.255
netname: NTT-BB-NET
descr: NTT Broadband Initiative Inc.
country: JP
admin-c: TY5499JP
tech-c: TY5499JP
remarks: This information has been partially mirrored by APNIC from
remarks: JPNIC. To obtain more specific information, please use the
remarks: JPNIC whois server at whois.nic.ad.jp. (This defaults to
remarks: Japanese output, use the /e switch for English output)
changed: apnic-ftp@nic.ad.jp 20020620
remarks: This information has been partially mirrored by APNIC from
remarks: JPNIC. To obtain more specific information, please use the
remarks: JPNIC whois server at whois.nic.ad.jp. (This defaults to
remarks: Japanese output, use the /e switch for English output)
changed: apnic-ftp@nic.ad.jp 20030326
source: JPNIC

-------------------
inetnum: 193.77.0.0 - 193.77.255.255
netname: SI-TELEKOM-193-77
descr: SiOL d.o.o
descr: Provider Local Registry
country: SI
admin-c: VM439-RIPE
tech-c: TC124-RIPE
status: ALLOCATED UNSPECIFIED
remarks: -------------------------------------------------------
remarks: Please send abuse & spam notification to abuse@siol.net
remarks: -------------------------------------------------------
notify: vili.mozina@siol.net
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: AS5603-MNT
mnt-routes: AS5603-MNT
changed: hostmaster@ripe.net 19951219
changed: hostmaster@ripe.net 20020704
source: RIPE

route: 193.77.0.0/16
descr: SiOL.SI, Provider Aggregated Block
descr: SiOL d.o.o.
descr: Internet Service Provider in Slovenia
descr: http://www.siol.net
origin: AS5603
remarks: -------------------------------------------------------
remarks: Please send abuse & spam notification to abuse@siol.net
remarks: -------------------------------------------------------
notify: vili.mozina@siol.net
notify: noc@siol.si
mnt-by: AS5603-MNT
changed: damjan@nil.si 19960131
changed: vili.mozina@siol.net 20011128
changed: vili.mozina@siol.net 20020425
changed: vili.mozina@siol.net 20020828
changed: vili.mozina@siol.net 20021007
source: RIPE

person: Vili Mozina
address: SiOL Internet d.o.o.
address: Cigaletova 15
address: 1000 Ljubljana
address: Slovenia
phone: +386-1-437-00-00
fax-no: +386-1-437-00-17
e-mail: vili.mozina@siol.net
nic-hdl: VM439-RIPE
notify: vili.mozina@siol.net
changed: vili.mozina@siol.net 20000818
source: RIPE

person: Tom Cof
address: SiOL Internet d.o.o.
address: Cigaletova 15
address: 1000 Ljubljana
address: Slovenia
phone: +386-1-437-00-00
fax-no: +386-1-437-00-16
e-mail: tom.cof@siol.net
nic-hdl: TC124-RIPE
notify: tom.cof@siol.net
changed: jan.zorz@siol.net 19990824
changed: vili.mozina@siol.net 20000818
source: RIPE

[S. Pfeffer]

Zu dem Thema gabs vor kurzem auch was in der ct - weiss jetzt allerdings nicht welche. Aber Distributionspassend:
<a href="http://sdb.suse.de/de/sdb/html/fhassel_ ... ering.html" target="_blank"><!--auto-->http://sdb.suse.de/de/sdb/html/fhassel_ ... <!--auto-->

[fred]

Vielen Dank!
1. Man muß halt auch suchen können!
2. Jetzt wird mir auch klar
Mar 31 23:56:03 lilo kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=63.186.137.196 DST=217.232.10.213 LEN=78 TOS=0x00 PREC=0x00 TTL=119 ID=41853
PROTO=UDP SPT=1030 DPT=137 LEN=58

Client versucht über 137 Verbindung aufzunehmen.


Mar 31 23:56:54 lilo kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=65.49.84.197 DST=217.232.10.213 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=26271 DF PROTO=TCP
SPT=4982 DPT=1193 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A1D60EA6F0000000001030300)

Versucht über angeblich bestehende Verbindung zu senden.

schauen wir mal.