怎样理解这个OUTPUT链的日志？

[i=s] 本帖最后由 LINUX_COM 于 2010-2-23 14:09 编辑 [/i]

#! /bin/bash
IPTABLE=/sbin/iptables
$IPTABLE -F

$IPTABLE -A OUTPUT -m state --state NEW -j LOG --log-prefix "OUTPUT_日志"

$IPTABLE -A INPUT -i ppp0 -m state --state INVALID -j LOG --log-prefix "恶意连接_日志" --log-ip-options
$IPTABLE -A INPUT -i ppp0 -m state --state INVALID -j DROP #丢弃
$IPTABLE -A INPUT -i ppp0 -m state --state ESTABLISHED -j LOG --log-prefix "正确连接_日志" --log-ip-options
$IPTABLE -A INPUT -i ppp0 -m state --state ESTABLISHED -j ACCEPT

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
Feb 21 16:23:11 w-laptop kernel: [ 259.681250] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=1353 TOS=0x00 PREC=0x00 TTL=64 ID=10742 DF PROTO=TCP SPT=60696 DPT=80 WINDOW=2003 RES=0x00 ACK PSH URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.697734] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=54423 DF PROTO=TCP SPT=60700 DPT=80 WINDOW=1082 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.698529] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=54424 DF PROTO=TCP SPT=60700 DPT=80 WINDOW=1082 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.701785] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=1353 TOS=0x00 PREC=0x00 TTL=64 ID=54425 DF PROTO=TCP SPT=60700 DPT=80 WINDOW=1082 RES=0x00 ACK PSH URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.705330] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36727 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.718412] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36728 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.731720] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36729 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.745001] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36730 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.758321] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36731 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.771636] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36732 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.784671] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36733 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.796757] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5701 DF PROTO=TCP SPT=60698 DPT=80 WINDOW=2003 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.797287] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=1353 TOS=0x00 PREC=0x00 TTL=64 ID=5702 DF PROTO=TCP SPT=60698 DPT=80 WINDOW=2003 RES=0x00 ACK PSH URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.799648] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=59328 DF PROTO=TCP SPT=60699 DPT=80 WINDOW=2003 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.800002] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=10955 DF PROTO=TCP SPT=60703 DPT=80 WINDOW=182 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.804199] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=1353 TOS=0x00 PREC=0x00 TTL=64 ID=10956 DF PROTO=TCP SPT=60703 DPT=80 WINDOW=182 RES=0x00 ACK PSH URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.804370] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=1353 TOS=0x00 PREC=0x00 TTL=64 ID=59329 DF PROTO=TCP SPT=60699 DPT=80 WINDOW=2003 RES=0x00 ACK PSH URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.804527] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=1353 TOS=0x00 PREC=0x00 TTL=64 ID=54776 DF PROTO=TCP SPT=60697 DPT=80 WINDOW=1892 RES=0x00 ACK PSH URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.810053] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36734 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.823345] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36735 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.836586] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36736 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.849718] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36737 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.863019] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36738 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.876350] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36739 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.889384] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36740 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.902703] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36741 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.912404] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=1353 TOS=0x00 PREC=0x00 TTL=64 ID=54426 DF PROTO=TCP SPT=60700 DPT=80 WINDOW=1172 RES=0x00 ACK PSH URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.917918] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=10957 DF PROTO=TCP SPT=60703 DPT=80 WINDOW=217 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.929925] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=1353 TOS=0x00 PREC=0x00 TTL=64 ID=10958 DF PROTO=TCP SPT=60703 DPT=80 WINDOW=217 RES=0x00 ACK PSH URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.930119] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=1353 TOS=0x00 PREC=0x00 TTL=64 ID=5703 DF PROTO=TCP SPT=60698 DPT=80 WINDOW=2003 RES=0x00 ACK PSH URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.931262] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36742 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.944588] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36743 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:11 w-laptop kernel: [ 259.948049] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=61.55.167.138 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=10743 DF PROTO=TCP SPT=60696 DPT=80 WINDOW=2003 RES=0x00 ACK URGP=0
Feb 21 16:23:12 w-laptop kernel: [ 259.957901] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36744 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:12 w-laptop kernel: [ 259.970959] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36745 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:12 w-laptop kernel: [ 259.984267] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36746 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:12 w-laptop kernel: [ 259.997567] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36747 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0
Feb 21 16:23:12 w-laptop kernel: [ 260.010884] OUTPUT_日志IN= OUT=ppp0 SRC=116.27.121.138 DST=121.9.203.20 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36748 DF PROTO=TCP SPT=46212 DPT=80 WINDOW=43560 RES=0x00 ACK URGP=0


－－－－－－－－－－－－－－－－－－－－－－－－
单机，联网，并没执行任何程序。

FIREFOX并没打开任何网页，这条OUTPUT链应该指：本机电脑向外部电脑发送数据包，本机电脑并没执行任何程序，为什么会有这些日志？