From: Ramin Alidousti <ramin@cannon.eng.us.uu.net>
To: netfilter@lists.samba.org
Cc: Raymond Leach <raymondl@knowledgefactory.co.za>,
blacknet@simplyaquatics.com
Subject: Re: Strange log entry ...
Date: Mon, 8 Jul 2002 13:15:16 -0400 [thread overview]
Message-ID: <20020708171516.GS25368@cannon.eng.us.uu.net> (raw)
In-Reply-To: <20020708143656.GR25368@cannon.eng.us.uu.net>
On Mon, Jul 08, 2002 at 10:36:56AM -0400, Ramin Alidousti wrote:
> On Mon, Jul 08, 2002 at 04:29:51PM +0200, Raymond Leach wrote:
>
> > On Mon, 2002-07-08 at 16:07, Ed Street wrote:
> > > Hello,
> > >
> > >
> > > Looks like station 10.0.0.19 on eth2 tried to ping 199.181.167.201 and
> > > it was droped.
> > >
> > I've checked the process list on 10.0.0.19 and also restarted it just to
> > make sure, and there is nothing that is trying to ping anywhere.
> >
> > Isn't ICMP CODE 0 TYPE 0 a reply? Doesn't this log entry represent
> > 10.0.0.19's reply to an echo request?
>
> Don't you have any backdoor?? If not, then 10.0.0.19 might be replying
> to a spoofed ping from the inside...
Second thought. It probably isn't due to a backdoor as this backdoor
would need to do the same natting that you're doing on your firewall.
So it'd narrow down to the spoofed ping from the inside.
Ramin
next prev parent reply other threads:[~2002-07-08 17:15 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-07-08 14:07 Strange log entry Raymond Leach
2002-07-08 14:07 ` Ed Street
2002-07-08 14:29 ` Raymond Leach
2002-07-08 14:36 ` Ramin Alidousti
2002-07-08 17:15 ` Ramin Alidousti [this message]
2002-07-08 14:39 ` Ed Street
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20020708171516.GS25368@cannon.eng.us.uu.net \
--to=ramin@cannon.eng.us.uu.net \
--cc=blacknet@simplyaquatics.com \
--cc=netfilter@lists.samba.org \
--cc=raymondl@knowledgefactory.co.za \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox