weird interface !

weird interface !

[web master]

hello
i'm running a redhat machine and while checking
[root@localhost root]# ifconfig -a
lo        Link encap:Local Loopback
          LOOPBACK  MTU:16436  Metric:1
          RX packets:316 errors:0 dropped:0 overruns:0 frame:0
          TX packets:316 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:15800 (15.4 Kb)  TX bytes:15800 (15.4 Kb)

ppp0      Link encap:Point-to-Point Protocol
          inet addr:62.135.14.214  P-t-P:172.17.9.205  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1524  Metric:1
          RX packets:1739 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1942 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:528941 (516.5 Kb)  TX bytes:178970 (174.7 Kb)

tunl0     Link encap:IPIP Tunnel  HWaddr
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

[root@localhost root]#

i see tunl0 and i dont know who made it and why is it there its always 0.0 b 
and its always there even if ppp0 isnt up , so i'd like to investigate this 
, is my machine compromised or a software made it , please help me with it .

i though of running iptables to listen to what passes there .
any ideas ?
thanks in advance


_________________________________________________________________
Surf the Web without missing calls! Get MSN Broadband. 
http://resourcecenter.msn.com/access/plans/freeactivation.asp

Re: weird interface !

[Ben Russo]

On Tue, 2002-11-05 at 11:41, web master wrote:
> 
> 
> 
> hello
> i'm running a redhat machine and while checking
> [root@localhost root]# ifconfig -a
...
> tunl0     Link encap:IPIP Tunnel  HWaddr
>           NOARP  MTU:1480  Metric:1
>           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:0
>           RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
> 
> i see tunl0 and i dont know who made it and why is it there its always 0.0 b 
> and its always there even if ppp0 isnt up , so i'd like to investigate this 
> , is my machine compromised or a software made it , please help me with it .

This looks like a virtual network interface created by the tun.o kernel
module.

Check the output of 'lsmod' and see if you see any modules with "tun" in
the name.  You can also do a search on Google for "vtund"

-Ben.