diff options
Diffstat (limited to 'zarb-ml/mageia-discuss/20120507/007245.html')
| -rw-r--r-- | zarb-ml/mageia-discuss/20120507/007245.html | 121 |
1 files changed, 121 insertions, 0 deletions
diff --git a/zarb-ml/mageia-discuss/20120507/007245.html b/zarb-ml/mageia-discuss/20120507/007245.html new file mode 100644 index 000000000..d17d2ca56 --- /dev/null +++ b/zarb-ml/mageia-discuss/20120507/007245.html @@ -0,0 +1,121 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> +<HTML> + <HEAD> + <TITLE> [Mageia-discuss] Odd entry in log file + </TITLE> + <LINK REL="Index" HREF="index.html" > + <LINK REL="made" HREF="mailto:mageia-discuss%40mageia.org?Subject=Re%3A%20%5BMageia-discuss%5D%20Odd%20entry%20in%20log%20file&In-Reply-To=%3C201205072247.41931.alien%40rmail.be%3E"> + <META NAME="robots" CONTENT="index,nofollow"> + <META http-equiv="Content-Type" content="text/html; charset=us-ascii"> + <LINK REL="Previous" HREF="007236.html"> + <LINK REL="Next" HREF="007247.html"> + </HEAD> + <BODY BGCOLOR="#ffffff"> + <H1>[Mageia-discuss] Odd entry in log file</H1> + <B>Maarten Vanraes</B> + <A HREF="mailto:mageia-discuss%40mageia.org?Subject=Re%3A%20%5BMageia-discuss%5D%20Odd%20entry%20in%20log%20file&In-Reply-To=%3C201205072247.41931.alien%40rmail.be%3E" + TITLE="[Mageia-discuss] Odd entry in log file">alien at rmail.be + </A><BR> + <I>Mon May 7 22:47:41 CEST 2012</I> + <P><UL> + <LI>Previous message: <A HREF="007236.html">[Mageia-discuss] Odd entry in log file +</A></li> + <LI>Next message: <A HREF="007247.html">[Mageia-discuss] Odd entry in log file +</A></li> + <LI> <B>Messages sorted by:</B> + <a href="date.html#7245">[ date ]</a> + <a href="thread.html#7245">[ thread ]</a> + <a href="subject.html#7245">[ subject ]</a> + <a href="author.html#7245">[ author ]</a> + </LI> + </UL> + <HR> +<!--beginarticle--> +<PRE>Op maandag 07 mei 2012 14:23:44 schreef Frank Griffin: +><i> On 05/07/2012 06:45 AM, Frank Griffin wrote: +</I>><i> >> On 05/06/2012 09:15 PM, imnotpc wrote: +</I>><i> >> 1) Is eth0 the interface facing the internet ? +</I>><i> > +</I>><i> > No, this interface faces the LAN which has a 192.168.0.0/24 subnet. +</I>><i> +</I>><i> OK, so if eth0 has no outside internet access, you are correct in saying +</I>><i> that something in your network is doing this. +</I>><i> +</I>><i> >> 2) Is 173.194.74.154 the IP address assigned (currently) to you by +</I>><i> >> your ISP ? +</I>><i> > +</I>><i> > No, that IP returns to qe-in-f154.1e100.net which appears to be a +</I>><i> > server owned by Google. +</I>><i> +</I>><i> Yes. I thought maybe Google was your ISP. +</I>><i> +</I>><i> >> 4) What does "traceroute 192.168.3.2" from the gateway give ? +</I>><i> > +</I>><i> > [<A HREF="https://www.mageia.org/mailman/listinfo/mageia-discuss">root at Cedar1</A> /]# traceroute 192.168.3.2 +</I>><i> > traceroute to 192.168.3.2 (192.168.3.2), 30 hops max, 60 byte packets +</I>><i> > +</I>><i> > 1 74-94-209-242-BusName-VA.hfc.comcastbusiness.net (74.94.209.242) +</I>><i> > +</I>><i> > 0.670 ms 1.372 ms 1.686 ms +</I>><i> > +</I>><i> > 2 * * * +</I>><i> > +</I>><i> > Well isn't that interesting. That Comcast IP is the address of the ISP +</I>><i> > gateway I use. Both of my firewall/gateway boxes that are logging +</I>><i> > martian packets are connected to similar Comcast routers. The routers +</I>><i> > are configured in bridge mode so the router DHCP service has no effect +</I>><i> > on my connection, but it might still be active on the router. Also +</I>><i> > each ISP router also has a wireless interface and that could still be +</I>><i> > active. My firewall doesn't block any private IPs coming from the +</I>><i> > Internet interface since the ISP routers would never forward them, so +</I>><i> > that explains how they get past the firewall. +</I>><i> +</I>><i> No, I think traceroute doesn't special-case internal IP addresses. Your +</I>><i> routing table is (correctly) set up to route traffic for anything other +</I>><i> than your known subnets to the external internet, and that's exactly +</I>><i> what traceroute is doing. It's your ISP's job to discard internal +</I>><i> address packets, not yours. +</I>><i> +</I>><i> But I think you're on to something with the ISP routers. Is there some +</I>><i> reason you don't just run the cable from the cable modem to the external +</I>><i> NIC on the gateway PC ? If you're willing to try that, and the martians +</I>><i> disappear, it's these routers. +</I>><i> +</I>><i> Try going into configuration on these routers, and see what their DHCP +</I>><i> servers are set up for, and whether the 192.168.3 subnet appears +</I>><i> anywhere in there. It's possible that one of your DHCP-using wireless +</I>><i> clients is getting an answer to its broadcast from these guys before +</I>><i> your internal router, and picking up a 192.168.3.2 IP address from them. +</I> + +my martians are mostly from: hosts in subnet of my public IP, or internal +ranges from modems, and mostly broadcasts or arp stuff. + +i think this 192.168.3.1 stuff is likely someone in your ISP subnet that is +doing bad natting and is trying to get out (much like you pinging 192.168.3.x +which is going outside your public ip, that'll get martians on someone elses +pc for instance +</PRE> + + + +<!--endarticle--> + <HR> + <P><UL> + <!--threads--> + <LI>Previous message: <A HREF="007236.html">[Mageia-discuss] Odd entry in log file +</A></li> + <LI>Next message: <A HREF="007247.html">[Mageia-discuss] Odd entry in log file +</A></li> + <LI> <B>Messages sorted by:</B> + <a href="date.html#7245">[ date ]</a> + <a href="thread.html#7245">[ thread ]</a> + <a href="subject.html#7245">[ subject ]</a> + <a href="author.html#7245">[ author ]</a> + </LI> + </UL> + +<hr> +<a href="https://www.mageia.org/mailman/listinfo/mageia-discuss">More information about the Mageia-discuss +mailing list</a><br> +</body></html> |