> ----- /var/log/messages -----
>
> Nov 20 10:02:03 salaza icmpinfo: ICMP_Dest_Unreachable[Port]
> < 127.0.0.1 > 127.0.0.1 sp=1495 dp=512 seq=0x002902df sz=69(+20)
> Nov 20 10:02:03 salaza icmpinfo: ICMP_Dest_Unreachable[Port] < 127.0.0.1 > 127.0.0.1
> sp=1495 dp=512 seq=0x002902df sz=69(+20)
>
> I get the above set of messages when there is email for a user.
>
> /etc/services tells me it's either exec or biff. I don't have any server
> monitoring those 2 ports. Any idea why those connections are initiated?
you're getting the port unreachables because you don't have servers
running :). port unreachables are only sent for udp as far as I know. If
its tcp then the other end will send a reset. so for 512 it seems to be
biff. That makes sense as its probably just your mail delivery agent
trying to connect to biff to tell it that new mail has arrived.
> ---------- /var/log/messages ------------
> Nov 20 10:02:19 salaza icmpinfo: ICMP_Source_Quench < 203.4.212.58 >
> 203.10.16.255 sp=138 dp=138 seq=0x00df3fdd sz=36(+20)
>
>
> As well, any idea why the broadcast to port 138(netbios-dgm)?
> 203.4.212.58 is where my ppp link is connected to. Could it be
> that I'm running Samba?
if you're running the server, sure. 138/udp is used to broadcast
basically keep-alive/here-i-am messages to other smb servers on the net.
that is probably the other end telling you to shut the hell up :)
hope this helps..
-- zach