Re: Strange attacks in my log

Hi. On Thu, Feb 21, 2019 at 05:29:56PM +0100, Hans wrote: > Am Donnerstag, 21. Februar 2019, 16:46:42 CET schrieb Reco: > Yes, worked. However, I did not find any unusual, however, putting a stick in > is starting "colord-sane", which will explain the UDP request. Judging from the whoppi

Re: Strange attacks in my log

Am Donnerstag, 21. Februar 2019, 16:46:42 CET schrieb Reco: Yes, worked. However, I did not find any unusual, however, putting a stick in is starting "colord-sane", which will explain the UDP request. This does not explain, why a sd-card or usb-stick is calling this. The only explanation I have,

Re: Strange attacks in my log

Hi. On Thu, Feb 21, 2019 at 04:29:11PM +0100, Hans wrote: > Hmm, tried "auditctl -a always,exit -S connect -F arch=b64 auditctl -a always,exit -S connect Ignore 'syscall mismatch' warning, it will work anyway. > Tha manual told nothing about a logfile. It's /var/log/audit/audit.log. R

Re: Strange attacks in my log

Hmm, tried "auditctl -a always,exit -S connect -F arch=b64 Tha manual told nothing about a logfile. What do I do wrong? Hans wireshark_udp_192.168.2.117.pcap Description: application/vnd.tcpdump.pcap signature.asc Description: This is a digitally signed message part.

Re: Strange attacks in my log

Hi. On Thu, Feb 21, 2019 at 11:42:58AM +0100, Hans wrote: > Am Donnerstag, 21. Februar 2019, 11:19:08 CET schrieb Reco: > Hi Reco (and all others), > > sure, I attached the wireshark pcap. Thre is nothing secret in it. That's interesting. Aforementioned pcap does not contain udp:69, but

Re: Strange attacks in my log

Am Donnerstag, 21. Februar 2019, 11:19:08 CET schrieb Reco: Hi Reco (and all others), sure, I attached the wireshark pcap. Thre is nothing secret in it. However, I know, what the ports are for, but it is not understandable for me, why there are networking protocols are started, when I just put a

Re: Strange attacks in my log

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hans wrote: > Hi folks, > > I discovered some strange log entries, which are created by > "portsentry" (a tool for wathing port accesses). > > It looks like whenever I insert an USB-drive or a SD-Card, the own > system wants to access on an UDP-Port

Re: Strange attacks in my log

Hi. On Thu, Feb 21, 2019 at 10:29:49AM +0100, Hans wrote: > Hi folks, > > I discovered some strange log entries, which are created by "portsentry" (a > tool for > wathing port accesses). > > It looks like whenever I insert an USB-drive or a SD-Card, the own system > wants to > access

Strange attacks in my log

Hi folks, I discovered some strange log entries, which are created by "portsentry" (a tool for wathing port accesses). It looks like whenever I insert an USB-drive or a SD-Card, the own system wants to access on an UDP-Port (69 or 161). It tries also to access all other computers in the net