Unknown IPFW log message

[Chuck Swiger]

On Apr 28, 2010, at 9:34 AM, Jerry wrote:
> In the security.log, I have been noticing the following:
> 
> Apr 28 12:04:20 scorpio kernel: ipfw: 4400 Deny P:2 192.168.1.1 224.0.0.1 in via nfe0
> 
> I have not been able to document what the "P:2" stands for.

It's coming from /usr/src/sys/netinet/ip_fw2.c around line 1000; "P:2" indicates the packet was using IP protocol 2, aka IPPROTO_IGMP.  IGMP is most commonly used for streaming multimedia, some games, and I even think some types VPN connections like to use it....

Regards,
-- 
-Chuck