Hack or what?

Hack or what?

[Raymond Leach]

[-- Attachment #1: Type: text/plain, Size: 2123 bytes --]

Hi

Does this look like a hack attempt?

Sep 17 10:56:46 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.4 DST=66.27.234.75 LEN=45 TOS=0x00 PREC=0x00 TTL=127 ID=6691
PROTO=UDP SPT=8912 DPT=69 LEN=25
Sep 17 10:56:47 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.4 DST=66.27.234.75 LEN=45 TOS=0x00 PREC=0x00 TTL=127 ID=6760
PROTO=UDP SPT=8912 DPT=69 LEN=25
Sep 17 10:56:49 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.4 DST=66.27.234.75 LEN=45 TOS=0x00 PREC=0x00 TTL=127 ID=6946
PROTO=UDP SPT=8912 DPT=69 LEN=25
Sep 17 10:56:53 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.4 DST=66.27.234.75 LEN=45 TOS=0x00 PREC=0x00 TTL=127 ID=7199
PROTO=UDP SPT=8912 DPT=69 LEN=25
Sep 17 10:57:01 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.4 DST=66.27.234.75 LEN=45 TOS=0x00 PREC=0x00 TTL=127 ID=7654
PROTO=UDP SPT=8912 DPT=69 LEN=25
Sep 17 10:57:09 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.4 DST=66.27.234.75 LEN=45 TOS=0x00 PREC=0x00 TTL=127 ID=8266
PROTO=UDP SPT=8912 DPT=69 LEN=25
Sep 17 10:57:17 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.4 DST=66.27.234.75 LEN=45 TOS=0x00 PREC=0x00 TTL=127 ID=8795
PROTO=UDP SPT=8912 DPT=69 LEN=25
Sep 17 10:57:25 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.4 DST=66.27.234.75 LEN=45 TOS=0x00 PREC=0x00 TTL=127 ID=9205
PROTO=UDP SPT=8912 DPT=69 LEN=25
Sep 17 10:57:33 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.4 DST=66.27.234.75 LEN=51 TOS=0x00 PREC=0x00 TTL=127 ID=9656
PROTO=UDP SPT=8912 DPT=69 LEN=31

firefly:~ # nslookup 66.27.234.75
Server:  fireflyint
Address:  10.0.0.2

Name:    bak-66-27-234-75.bak.rr.com
Address:  66.27.234.75

-- 
----------------------------------------
Raymond Leach
Internet Infrastructure
Knowledge Factory
Tel: +27-11-445-8100 Fax: +27-11-445-8101
www: http://www.knowledgefactory.co.za
----------------------------------------
"It is a man's own fault if his mind grows
 torpid in old age." - Samual Jackson

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Hack or what?

[Sascha Reissner]

looks like you got whatever app running on 10.0.0.4 that tries to retrieve
or send files via tftp to that other IP address.

might be some virii trying to update its own code remotly, or whatever..
check 10.0.0.4 (must be an internal machine due to private ip range) what
processes are running and do some netstat -na to check open connections.