-
August 9th, 2002, 02:49 PM
#1
Senior Member
sniffer logging more packets than firewall is dropping
Quick question...
I'm running Ethereal, and I also have checkpoint's FW-1. I am running them on the same machine (just for testing purposes...I wouldn't do it in a production environment! ). Anyway...on Ethereal I notice 3 packets come in from the same IP going to the same service. Now on the FW, I only see one entry for that packet that is being dropped. Now the question is...why is only one entry showing up in the firewall logs? I'm taking a wild guess here, but could those 3 entries in Ethereal be fragments of one packet? Then does the firewall reassemble the packet, then just drop the one packet?
If this is the case, then how can I verify this?
Thanks!
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|