[users@httpd] configure logs to track source of outgoing requests

[j k <jo...@gmail.com>]

I am seeing some odd log entries like this:
Apr 10 05:14:09 OutDropped:IN= OUT=eth0 SRC=xx.xx.xx.xx
DST=66.249.31.43LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=47089 DF PROTO=TCP
SPT=37356 DPT=3306
WINDOW=5840 RES=0x00 SYN URGP=0

where xx.xx.xx.xx is the ip of our server, and 66.249.31.43 does not resolve
to a hostname but does respond to pings.

I'm wondering how to configure logging to show where these requests are
coming from so I can track down what is causing them?

Thanks.

[users@httpd] Re: configure logs to track source of outgoing requests

[j k <jo...@gmail.com>]

On Thu, Apr 10, 2008 at 9:32 PM, j k <jo...@gmail.com> wrote:

> I am seeing some odd log entries like this:
> Apr 10 05:14:09 OutDropped:IN= OUT=eth0 SRC=xx.xx.xx.xx DST=66.249.31.43LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=47089 DF PROTO=TCP SPT=37356 DPT=3306
> WINDOW=5840 RES=0x00 SYN URGP=0
>
> where xx.xx.xx.xx is the ip of our server, and 66.249.31.43 does not
> resolve to a hostname but does respond to pings.
>
> I'm wondering how to configure logging to show where these requests are
> coming from so I can track down what is causing them?
>

BTW I wasn't clear above, although I am showing a firewall log entry I am
asking about apache log configuration here as via apache is the most likely
source of the outgoing requests, maybe from javascript or the like. So is
there a way to insert some flag in the apache log to show for instnace which
virtual host a request comes from?
Or do I have this jumbled in my head and apache won't be logging anything
going out?
Thanks.