I’m getting these messages flooding my log from different source addresses. Is it port scanner?
firewall,info input: in:Internet out:(none), src-mac xx:xx:xx:xx:xx:xx, proto TCP (SYN), yyy.yyy.yyy.yyy:63123->xxx.xxx.xxx.xxx:27782, len 64
I have also several instances of RST, ACK, etc by themselves that are occurring during dictionary attacks.