analyze header problem

[Kuqsal 241]

SYSERR: Feb 20 05:51:34 :: Analyze: HANDSHAKE phase does not handle packet 71 (fd 25) (source 147.185.132.48:35069)
SYSERR: Feb 20 05:51:34 :: Process: Failed to analyze header(71) host(147.185.132.48)
SYSERR: Feb 20 08:42:02 :: Analyze: HANDSHAKE phase does not handle packet 71 (fd 25) (source 65.49.1.21:35290)
SYSERR: Feb 20 08:42:02 :: Process: Failed to analyze header(71) host(65.49.1.21)
SYSERR: Feb 20 22:50:59 :: Analyze: HANDSHAKE phase does not handle packet 22 (fd 26) (source 65.49.1.16:19432)
SYSERR: Feb 20 22:50:59 :: Process: Failed to analyze header(22) host(65.49.1.16)
SYSERR: Feb 21 09:44:39 :: Analyze: HANDSHAKE phase does not handle packet 71 (fd 25) (source 147.185.132.222:14571)
SYSERR: Feb 21 09:44:39 :: Process: Failed to analyze header(71) host(147.185.132.222)
SYSERR: Feb 21 11:53:39 :: Analyze: HANDSHAKE phase does not handle packet 22 (fd 25) (source 118.194.248.142:11949)
SYSERR: Feb 21 11:53:39 :: Process: Failed to analyze header(22) host(118.194.248.142)
SYSERR: Feb 21 11:53:59 :: Analyze: HANDSHAKE phase does not handle packet 71 (fd 25) (source 118.194.248.142:9353)
SYSERR: Feb 21 11:53:59 :: Process: Failed to analyze header(71) host(118.194.248.142)
SYSERR: Feb 21 11:54:18 :: Analyze: HANDSHAKE phase does not handle packet 5 (fd 25) (source 118.194.248.142:50336)
SYSERR: Feb 21 11:54:18 :: Process: Failed to analyze header(5) host(118.194.248.142)
SYSERR: Feb 21 11:54:19 :: Analyze: HANDSHAKE phase does not handle packet 3 (fd 25) (source 118.194.248.142:52384)
SYSERR: Feb 21 11:54:19 :: Process: Failed to analyze header(3) host(118.194.248.142)
SYSERR: Feb 21 11:54:19 :: Analyze: HANDSHAKE phase does not handle packet 3 (fd 25) (source 118.194.248.142:53408)
SYSERR: Feb 21 11:54:19 :: Process: Failed to analyze header(3) host(118.194.248.142)

I dont understand why this errors gave to me ?

[Khabib Nurmagomedov 388]

Those IP's are all on a report-list. If your server is open to the public, someone might be trying to attack it, otherwise, you are using a very public provider and someone is just scanning random ports on random IP classes in hope that they will bruteforce into your server or some random ones.

Edited February 21, 2025 by Khabib Nurmagomedov

[yomidseven 238]

6 minutes ago, Khabib Nurmagomedov said:

Those IP's are all on a report-list. If your server is open to the public, someone might be trying to attack it, otherwise, you are using a very public provider and someone is just scanning random ports on random IP classes in hope that they will bruteforce into your server or some random ones.

Can I ask you where I can find those list? I wanna block them all

Edited February 21, 2025 by yomidseven

[Khabib Nurmagomedov 388]

Just now, yomidseven said:

Can I ask you where I can find those list? I wanna clock them all

You quite literally can't... there are so many of them it is almost impossible. It could even be a IP of your internet provider being used to do that.

If you want a very, very good protection for your server i strongly recommend contacting @ Shogun, his services have never dissapointed.

[Kuqsal 241]

On 2/21/2025 at 5:44 PM, Khabib Nurmagomedov said:

Those IP's are all on a report-list. If your server is open to the public, someone might be trying to attack it, otherwise, you are using a very public provider and someone is just scanning random ports on random IP classes in hope that they will bruteforce into your server or some random ones.

How to I can block ?

[Khabib Nurmagomedov 388]

4 minutes ago, Kuqsal said:

How to I can block ?

You can't, i already gave few answers above. Hope this helps.

[Kuqsal 241]

"


#!/bin/sh
IPF="ipfw -q add"
ipfw -q -f flush

#loopback
$IPF 10 allow all from any to any via lo0
$IPF 20 deny all from any to 127.0.0.0/8
$IPF 30 deny all from 127.0.0.0/8 to any
$IPF 40 deny tcp from any to any frag

# stateful
$IPF 50 check-state
$IPF 60 allow tcp from any to any established
$IPF 70 allow all from any to any out keep-state
$IPF 80 allow icmp from any to any

# open port ftp (20, 21), ssh (22), mail (25)
#http (80), https (443), dns (53), mysql (3306)
default_udp_yes_ports='53'
default_tcp_yes_ports='22 53 3306'
default_tcp_no_ports=''

# here auth PORTs for "NORM"/"..." thing
metin2_udp_yes_ports='30001'
# here PORTs
metin2_tcp_yes_ports='30001 30003 30005 30007 30009 30011 30013 30015 30017 30019 30021 30023 30025 30027 30029 30031 30033 30035 30037 30039 30041 30043'
# here DB_PORTs and P2P_PORTs
metin2_tcp_no_ports='30000 30002 30004 30006 30008 30010 30012 30014 30016 30018 30020 30022 30024 30026 30028 30030 30032 30034 30036 30038 30040 30042 30044'

# merge lists
udp_yes_ports="$default_udp_yes_ports $metin2_udp_yes_ports"
tcp_yes_ports="$default_tcp_yes_ports $metin2_tcp_yes_ports"
tcp_nop_ports="$default_tcp_no_ports $metin2_tcp_no_ports"

# white ip list
white_sites='31.58.245.51'

# block tcp/udp ports
for val in $tcp_nop_ports; do
    $IPF 2220 allow all from 127.0.0.0/8 to any $val
    for whitez in $white_sites; do
        $IPF 2210 allow tcp from $whitez to any $val in
        $IPF 2210 allow tcp from 127.0.0.0/8 to $whitez $val out
    done
    $IPF 2230 deny all from any to me $val
done
# unblock tcp ports
for val in $tcp_yes_ports; do
    $IPF 2200 allow tcp from any to any $val in limit src-addr 20
    $IPF 2210 allow tcp from any to any $val out
done
# unblock udp ports
for val in $udp_yes_ports; do
    $IPF 2200 allow udp from any to any $val in limit src-addr 20
    $IPF 2210 allow udp from any to any $val out
done



"

I think This ipfw.rule is enought for port sec