(I sent this to a BSM mailing list, but I then realized Kernel coders might have a good idea of what is going on)
I am looking at some Snow Leopard BSM audit trails for web connection between two Snow Leopard machines. The accept() system call on the httpd shows an AUT_SOCKINET128 (socket-inet6) token with an address family of 26, not an address family of AF_INET (2) for IPv4 or AF_INET6 (30) for IPv6.
And the audit record's remote host's port number of 21984 doesn't appear to be anything like I was seeing via tcpdump (a port of 57429).
Does anyone have any idea what this is about?
Todd
praudit output:
header,100,11,accept(2),0,Fri Apr 9 14:13:10 2010, + 313 msec argument,1,0x3,fd socket-inet6,26,21984,::ffff:192.168.10.69 subject,-1,_www,_www,_www,_www,62,100000,0,0.0.0.0 return,success,14 trailer,100
tcpdump packet:
14:13:10.380312 IP 192.168.10.69.57429 > 192.168.10.101.80: Flags [S], seq 4279854411, win 65535, options [mss 1460,nop,wscale 3,nop,nop,TS val 425144908 ecr 0,sackOK,eol], length 0
|