[ILUG] ipchains and ports 3/4

[Martin Feeney]

I have a weird situation in work.  I've just recently set up a two-tier 
firewall (cisco router and linux and ipchains).  Packets I was denying and 
logging were being sent to ports 3 and 4.

These packets seemed to be coming from Lotus Notes.  3 is said to be 
compressnet (never heard of it, but I'm guessing it's some sort of 
compressed data protocol).  4 is unused.

At the moment I'm forwarding the packets on to their destination (behind 
the firewall), but I'm not happy about it. Lotus Notes won't without it, 
though.

Anyone have more information on these ports or Lotus Notes' behaviour?

Log:

Apr 12 18:26:30 banba kernel: Packet log: forward ACCEPT eth0 PROTO=1 
<Firewall address>:3 <notes server behind firewall>:4 L=56 S=0x00 I=1801 
F=0x0000 T=254 (#6)
Apr 12 18:27:56 banba kernel: Packet log: forward ACCEPT eth0 PROTO=1 
<Firewall address>:3 <notes server behind firewall>:4 L=56 S=0x00 I=1802 
F=0x0000 T=254 (#6)

Generally get two packets at a time, then nothing for a few minuts (maybe 
it's some sort of fscked up authentication packet?).