On Fri, Feb 02, 2001 at 05:50:29PM -0600, Tanner, Robby wrote:
>Well, I just found the following lines in the log and shut down my server.
>What caused this?
>Why would 204.112.40.3 being trying to connect to itself?
>
>Feb 2 14:53:07 weisktsv03 kernel: Packet log: input DENY lo PROTO=6
>204.112.40.
>3:1026 204.112.40.3:21 L=60 S=0x00 I=13145 F=0x4000 T=64 SYN (#12)
>Feb 2 14:53:10 weisktsv03 kernel: Packet log: input DENY lo PROTO=6
>204.112.40.
>3:1026 204.112.40.3:21 L=60 S=0x00 I=13146 F=0x4000 T=64 SYN (#12)
>Feb 2 14:53:22 weisktsv03 inetd[3748]: execv /usr/sbin/in.identd: No such
>file
>or directory
Somone was trying to connect to your FTP port (perhaps a Ramen instance?),
then there was a connectino to your ident port. Apparently you don't have
ident installed. Do you have any reason to believe you've been compromised?
The above doesn't indicate it to me...
Sean
--
He who wonders discovers that this in itself is wonder.
-- M. C. Escher
Sean Reifschneider, Inimitably Superfluous <[EMAIL PROTECTED]>
tummy.com - Linux Consulting since 1995. Qmail, KRUD, Firewalls, Python
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
