I guess I'm still learning how to identify the traffic... Here's one example of a Facebook IP being blocked: 2016:03:16-16:50:48 atl ulogd[8305]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth1" srcmac="68:05:ca:3e:fc:bf" srcip="31.13.69.229" dstip="192.168.2.112" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="443" dstport="54590" tcpflags="RST" Here's one from an Apple IP: 2016:03:16-15:39:49 atl ulogd[8305]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth1" srcmac="68:05:ca:3e:fc:bf" srcip="17.173.66.136" dstip="192.168.2.112" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="443" dstport="54471" tcpflags="RST"
↧