iptables and logging

[ant2ne]

Ha, looks like a simultaneous post. I will adjust my script to resemble yours.

[Doug S]

10.1.1.69 is me. I'm not hosting anything on port 80. So this looks like me connecting to a web server.

Yes, that is packets from whomever you have an HTTP session open with. You can tell more about what is going on by the TCP flags: The first entry is the end of a session close sequence; The second and third entries are regular packet stuff mid session; The last entry is a trying to reset the connection (some systems use RST and some use FIN to terminate sessions).