summaryrefslogtreecommitdiffstats
path: root/zarb-ml/mageia-discuss/20120508/007252.html
blob: 38ba5d3723955f036e55ccc91e2923521551c7e0 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
 <HEAD>
   <TITLE> [Mageia-discuss] Odd entry in log file
   </TITLE>
   <LINK REL="Index" HREF="index.html" >
   <LINK REL="made" HREF="mailto:mageia-discuss%40mageia.org?Subject=Re%3A%20%5BMageia-discuss%5D%20Odd%20entry%20in%20log%20file&In-Reply-To=%3C4FA86022.3070905%40Rock3d.net%3E">
   <META NAME="robots" CONTENT="index,nofollow">
   <META http-equiv="Content-Type" content="text/html; charset=us-ascii">
   <LINK REL="Previous"  HREF="007259.html">
   <LINK REL="Next"  HREF="007253.html">
 </HEAD>
 <BODY BGCOLOR="#ffffff">
   <H1>[Mageia-discuss] Odd entry in log file</H1>
    <B>imnotpc</B> 
    <A HREF="mailto:mageia-discuss%40mageia.org?Subject=Re%3A%20%5BMageia-discuss%5D%20Odd%20entry%20in%20log%20file&In-Reply-To=%3C4FA86022.3070905%40Rock3d.net%3E"
       TITLE="[Mageia-discuss] Odd entry in log file">imnotpc at Rock3d.net
       </A><BR>
    <I>Tue May  8 01:52:02 CEST 2012</I>
    <P><UL>
        <LI>Previous message: <A HREF="007259.html">[Mageia-discuss] Odd entry in log file
</A></li>
        <LI>Next message: <A HREF="007253.html">[Mageia-discuss] Odd entry in log file
</A></li>
         <LI> <B>Messages sorted by:</B> 
              <a href="date.html#7252">[ date ]</a>
              <a href="thread.html#7252">[ thread ]</a>
              <a href="subject.html#7252">[ subject ]</a>
              <a href="author.html#7252">[ author ]</a>
         </LI>
       </UL>
    <HR>  
<!--beginarticle-->
<PRE>On 05/07/2012 04:47 PM, Maarten Vanraes wrote:
&gt;<i> Op maandag 07 mei 2012 14:23:44 schreef Frank Griffin:
</I>&gt;&gt;<i> On 05/07/2012 06:45 AM, Frank Griffin wrote:
</I>&gt;&gt;&gt;&gt;<i> On 05/06/2012 09:15 PM, imnotpc wrote:
</I>&gt;&gt;&gt;&gt;<i> 1) Is eth0 the interface facing the internet ?
</I>&gt;&gt;&gt;<i> No, this interface faces the LAN which has a 192.168.0.0/24 subnet.
</I>&gt;&gt;<i> OK, so if eth0 has no outside internet access, you are correct in saying
</I>&gt;&gt;<i> that something in your network is doing this.
</I>&gt;&gt;<i>
</I>&gt;&gt;&gt;&gt;<i> 2) Is 173.194.74.154 the IP address assigned (currently) to you by
</I>&gt;&gt;&gt;&gt;<i> your ISP ?
</I>&gt;&gt;&gt;<i> No, that IP returns to qe-in-f154.1e100.net which appears to be a
</I>&gt;&gt;&gt;<i> server owned by Google.
</I>&gt;&gt;<i> Yes.  I thought maybe Google was your ISP.
</I>&gt;&gt;<i>
</I>&gt;&gt;&gt;&gt;<i> 4) What does &quot;traceroute 192.168.3.2&quot; from the gateway give ?
</I>&gt;&gt;&gt;<i> [<A HREF="https://www.mageia.org/mailman/listinfo/mageia-discuss">root at Cedar1</A> /]# traceroute 192.168.3.2
</I>&gt;&gt;&gt;<i> traceroute to 192.168.3.2 (192.168.3.2), 30 hops max, 60 byte packets
</I>&gt;&gt;&gt;<i>
</I>&gt;&gt;&gt;<i>   1  74-94-209-242-BusName-VA.hfc.comcastbusiness.net (74.94.209.242)
</I>&gt;&gt;&gt;<i>
</I>&gt;&gt;&gt;<i> 0.670 ms  1.372 ms  1.686 ms
</I>&gt;&gt;&gt;<i>
</I>&gt;&gt;&gt;<i>   2  * * *
</I>&gt;&gt;&gt;<i>
</I>&gt;&gt;&gt;<i> Well isn't that interesting. That Comcast IP is the address of the ISP
</I>&gt;&gt;&gt;<i> gateway I use. Both of my firewall/gateway boxes that are logging
</I>&gt;&gt;&gt;<i> martian packets are connected to similar Comcast routers. The routers
</I>&gt;&gt;&gt;<i> are configured in bridge mode so the router DHCP service has no effect
</I>&gt;&gt;&gt;<i> on my connection, but it might still be active on the router. Also
</I>&gt;&gt;&gt;<i> each ISP router also has a wireless interface and that could still be
</I>&gt;&gt;&gt;<i> active. My firewall doesn't block any private IPs coming from the
</I>&gt;&gt;&gt;<i> Internet interface since the ISP routers would never forward them, so
</I>&gt;&gt;&gt;<i> that explains how they get past the firewall.
</I>&gt;&gt;<i> No, I think traceroute doesn't special-case internal IP addresses.  Your
</I>&gt;&gt;<i> routing table is (correctly) set up to route traffic for anything other
</I>&gt;&gt;<i> than your known subnets to the external internet, and that's exactly
</I>&gt;&gt;<i> what traceroute is doing.  It's your ISP's job to discard internal
</I>&gt;&gt;<i> address packets, not yours.
</I>&gt;&gt;<i>
</I>&gt;&gt;<i> But I think you're on to something with the ISP routers.  Is there some
</I>&gt;&gt;<i> reason you don't just run the cable from the cable modem to the external
</I>&gt;&gt;<i> NIC on the gateway PC ?  If you're willing to try that, and the martians
</I>&gt;&gt;<i> disappear, it's these routers.
</I>&gt;&gt;<i>
</I>&gt;&gt;<i> Try going into configuration on these routers, and see what their DHCP
</I>&gt;&gt;<i> servers are set up for, and whether the 192.168.3 subnet appears
</I>&gt;&gt;<i> anywhere in there.  It's possible that one of your DHCP-using wireless
</I>&gt;&gt;<i> clients is getting an answer to its broadcast from these guys before
</I>&gt;&gt;<i> your internal router, and picking up a 192.168.3.2 IP address from them.
</I>&gt;<i>
</I>&gt;<i> my martians are mostly from: hosts in subnet of my public IP, or internal
</I>&gt;<i> ranges from modems, and mostly broadcasts or arp stuff.
</I>&gt;<i>
</I>&gt;<i> i think this 192.168.3.1 stuff is likely someone in your ISP subnet that is
</I>&gt;<i> doing bad natting and is trying to get out (much like you pinging 192.168.3.x
</I>&gt;<i> which is going outside your public ip, that'll get martians on someone elses
</I>&gt;<i> pc for instance
</I>
Since it seems to be coming in on the LAN facing interface, wouldn't it 
be more likely a bad configuration somewhere in my LAN? Everything seems 
to point to my cheap Netgear wireless router even though I just 
rechecked it and it's configured properly (to the best of my knowledge).

Jeff
</PRE>






<!--endarticle-->
    <HR>
    <P><UL>
        <!--threads-->
	<LI>Previous message: <A HREF="007259.html">[Mageia-discuss] Odd entry in log file
</A></li>
	<LI>Next message: <A HREF="007253.html">[Mageia-discuss] Odd entry in log file
</A></li>
         <LI> <B>Messages sorted by:</B> 
              <a href="date.html#7252">[ date ]</a>
              <a href="thread.html#7252">[ thread ]</a>
              <a href="subject.html#7252">[ subject ]</a>
              <a href="author.html#7252">[ author ]</a>
         </LI>
       </UL>

<hr>
<a href="https://www.mageia.org/mailman/listinfo/mageia-discuss">More information about the Mageia-discuss
mailing list</a><br>
</body></html>