Re: [cobalt-security] Why does PortSentry continue to log ports 137 and 138 even though I've told it not to?

[John Bailey <support@xxxxxxxxxxxxxxxxxxxxxx>]

On Tue, 1 May 2001, Dan wrote:

> Can anyone help?
<snip>

Hi,

I've not seen the script in question, but I'd hazard a guess that it's
setting up ipchains to log denied or dropped packets.  This is done by
adding a '-l' switch to the ipchains command, for example:

ipchains -A output -j DENY -s 0.0.0.0/0 -d 0.0.0.0/0 -l

I'd suggest you have a look at the script and see if that's the case.

Cheers,

John