Re: strange connetions to exodus.net

[Andreas Meyer <anmeyer@gmx.net>]

Jeffrey Laramie <JALaramie@Loudoun-Fairfax.com> wrote:

> > Ted:
> >
> > Feb 21 16:59:22 delta kernel: DROP-TCP :IN= OUT=eth1 SRC=192.168.20.60 \
> >  DST=209.225.11.237 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=TCP \
> >  SPT=41504 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
> > Feb 21 16:59:23 delta kernel: DROP-TCP :IN= OUT=eth1 SRC=192.168.20.60 \
> >  DST=82.139.196.116 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22160 PROTO=TCP \
> >  SPT=41501 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
> >
> > Good point but this is my own site at 82.139.196.116 and I am sure
> > there is nothing pointing to exodus.net. Is this a DNS thing?
> 
> I don't see any IPs in your postings that point to exodus.net so I don't know 
> where you're seeing that. The IP in your first posting is most likely adware 
> running on the client 192.168.20.60 and the IP in your 2nd posting doesn't 
> resolve. You need to check the processes running on 192.168.20.60 to see 
> which one is calling these sites.

# dig -x 209.225.0.6

; <<>> DiG 9.2.2 <<>> -x 209.225.0.6
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65525
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 0

;; QUESTION SECTION:
;6.0.225.209.in-addr.arpa.      IN      PTR

;; ANSWER SECTION:
6.0.225.209.in-addr.arpa. 3600  IN      PTR     servedby.advertising.com.

;; AUTHORITY SECTION:
0.225.209.in-addr.arpa. 3600    IN      NS      dns03.exodus.net.
0.225.209.in-addr.arpa. 3600    IN      NS      dns04.exodus.net.
0.225.209.in-addr.arpa. 3600    IN      NS      dns01.exodus.net.
0.225.209.in-addr.arpa. 3600    IN      NS      dns02.exodus.net.

;; Query time: 290 msec
;; SERVER: 192.168.1.75#53(192.168.1.75)
;; WHEN: Sat Feb 21 18:01:40 2004
;; MSG SIZE  rcvd: 170

# dig -x 209.225.11.237

; <<>> DiG 9.2.2 <<>> -x 209.225.11.237
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 64855
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;237.11.225.209.in-addr.arpa.   IN      PTR

;; AUTHORITY SECTION:
11.225.209.in-addr.arpa. 3600   IN      SOA     dns01.exodus.net. hostmaster.exodus.net.11.225.209.in-addr.arpa. 2002091300 10800 3600 604800 86400


My LAN looks like this:

WKS 192.168.1.3 connection per webbrowser to Squid at 192.168.1.75
and the request from Squid is routed to the gateway 192.168.20.210

and as soon I start a request a tail -f /var/log/firewall on the
Squid-machine shows the request the above IPs. I don't known why.


-- 
   Andreas Meyer   | http://www.anup.de
                   | http://homeservice.anup.de/andreas