Re: udp port 32794

2002-03-15 Thread Roland Stoll
Noah L. Meyerhans wrote: > On Fri, Mar 15, 2002 at 09:09:15PM +0100, Roland Stoll wrote: > >>i'm wondering what this could be. Is it a known exploit, or just a new >>P2P software like gnutella/kaza/etc ? > > > It is traceroute. Ah, i remember that traceroute connects to high ports, increments

Re: 2.2.18 exploit, and updating the kernel

2002-03-15 Thread Francesco P. Lovergine
On Fri, Mar 15, 2002 at 06:16:22PM -0500, [EMAIL PROTECTED] wrote: > I have a potato system - with the 2.2.18 kernel. Somone has gotten into a box > on my network and used this exploit to gain root: > http://:infected.ilm.net/xpl0itz/l1nux/epcs2.c+epcs2&hl=en&ie=ISO-8859-1 > The other boxes that

Re: wierd connection attempt

2002-03-15 Thread Josh Frick
Noah L. Meyerhans wrote: On Fri, Mar 15, 2002 at 06:40:45AM -0500, Josh Frick wrote: I thought class C networks were non-routable. I think you're confused. First of all I think you're confused as to what a class C network is, and second of all I think you're confused as to what networks ar

Re: wierd connection attempt

2002-03-15 Thread Will Wesley, CCNA
Josh Frick wrote: > > Yes, I most definitely was confused. Thank you for the clarification. > I'm not familiar with the RFCs. My question, however, remains: > aren't network addresses in that range supposed to be prevented from > crossing (i.e. being routed) the internet? If they are, then

Re: wierd connection attempt

2002-03-15 Thread Josh Frick
Noah L. Meyerhans wrote: >On Fri, Mar 15, 2002 at 06:40:45AM -0500, Josh Frick wrote: > >>I thought class C networks were non-routable. >> > >I think you're confused. First of all I think you're confused as to >what a class C network is, and second of all I think you're confused as >to what netw

Re: 2.2.18 exploit, and updating the kernel

2002-03-15 Thread B Beck
On Fri, 15 Mar 2002 18:16:22 EST [EMAIL PROTECTED] wrote: I get: "Could not connect to remote server" when I try to follow that link. I get: "The address is not available from this machine" when I strip out the extra leading ":" :) I am curious as to seeing what potato is vulnerable to. However:

Re: ipmasq + port filtering recipe?

2002-03-15 Thread Jerry Lynde
At 03:11 PM 3/15/2002, Luke Scharf wrote: I've searched http://groups.google.com and and the web for a quick recipe. I've also scanned the general documentation, but I haven't figured out exactly how to do this yet. I have a machine that's running Debian Potato a web server and an ipmasq. The

Re: ipmasq + port filtering recipe?

2002-03-15 Thread Ted Cabeen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Content-Type: text/plain; charset=us-ascii In message <[EMAIL PROTECTED]>, Luke Scharf writes: >I have a machine that's running Debian Potato a web server and an >ipmasq. The machine has an "internal" and "external" network card. The >internal netwo

2.2.18 exploit, and updating the kernel

2002-03-15 Thread DORolfe
I have a potato system - with the 2.2.18 kernel. Somone has gotten into a box on my network and used this exploit to gain root: http://:infected.ilm.net/xpl0itz/l1nux/epcs2.c+epcs2&hl=en&ie=ISO-8859-1 The other boxes that are net accessible are openbsd -- This system is a dual p6 so I need debia

Re: 2.2.18 exploit, and updating the kernel

2002-03-15 Thread B Beck
On Fri, 15 Mar 2002 18:16:22 EST [EMAIL PROTECTED] wrote: I get: "Could not connect to remote server" when I try to follow that link. I get: "The address is not available from this machine" when I strip out the extra leading ":" :) I am curious as to seeing what potato is vulnerable to. However:

ipmasq + port filtering recipe?

2002-03-15 Thread Luke Scharf
I've searched http://groups.google.com and and the web for a quick recipe. I've also scanned the general documentation, but I haven't figured out exactly how to do this yet. I have a machine that's running Debian Potato a web server and an ipmasq. The machine has an "internal" and "external" net

Re: ipmasq + port filtering recipe?

2002-03-15 Thread Jerry Lynde
At 03:11 PM 3/15/2002, Luke Scharf wrote: >I've searched http://groups.google.com and and the web for a quick >recipe. I've also scanned the general documentation, but I haven't >figured out exactly how to do this yet. > >I have a machine that's running Debian Potato a web server and an >ipmasq.

Re: udp port 32794

2002-03-15 Thread Noah L. Meyerhans
On Fri, Mar 15, 2002 at 09:09:15PM +0100, Roland Stoll wrote: > i'm wondering what this could be. Is it a known exploit, or just a new > P2P software like gnutella/kaza/etc ? It is traceroute. -- ___ | Web: http://web.morgul.net/~frodo/ | PGP

Re: ipmasq + port filtering recipe?

2002-03-15 Thread Ted Cabeen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Content-Type: text/plain; charset=us-ascii In message <1016230298.20826.8.camel@garcon>, Luke Scharf writes: >I have a machine that's running Debian Potato a web server and an >ipmasq. The machine has an "internal" and "external" network card. The

2.2.18 exploit, and updating the kernel

2002-03-15 Thread DORolfe
I have a potato system - with the 2.2.18 kernel. Somone has gotten into a box on my network and used this exploit to gain root: http://:infected.ilm.net/xpl0itz/l1nux/epcs2.c+epcs2&hl=en&ie=ISO-8859-1 The other boxes that are net accessible are openbsd -- This system is a dual p6 so I need debi

udp port 32794

2002-03-15 Thread Roland Stoll
Hello, since a few days i have tons like this in my log: grobi kernel: Packet log: input DENY ppp0 PROTO=17 xxx.xxx.xxx.xxx: xxx.xxx.xxx.xxx:32794 L=37 S=0x00 I=41867 F=0x T=117 (#4) the packets come from many different addresses and always in a bunch of 3 - 5. i'm wondering what thi

ipmasq + port filtering recipe?

2002-03-15 Thread Luke Scharf
I've searched http://groups.google.com and and the web for a quick recipe. I've also scanned the general documentation, but I haven't figured out exactly how to do this yet. I have a machine that's running Debian Potato a web server and an ipmasq. The machine has an "internal" and "external" ne

Re: udp port 32794

2002-03-15 Thread Noah L. Meyerhans
On Fri, Mar 15, 2002 at 09:09:15PM +0100, Roland Stoll wrote: > i'm wondering what this could be. Is it a known exploit, or just a new > P2P software like gnutella/kaza/etc ? It is traceroute. -- ___ | Web: http://web.morgul.net/~frodo/ | PG

udp port 32794

2002-03-15 Thread Roland Stoll
Hello, since a few days i have tons like this in my log: grobi kernel: Packet log: input DENY ppp0 PROTO=17 xxx.xxx.xxx.xxx: xxx.xxx.xxx.xxx:32794 L=37 S=0x00 I=41867 F=0x T=117 (#4) the packets come from many different addresses and always in a bunch of 3 - 5. i'm wondering what this

Re: wierd connection attempt

2002-03-15 Thread Noah L. Meyerhans
On Fri, Mar 15, 2002 at 06:40:45AM -0500, Josh Frick wrote: > > > I thought class C networks were non-routable. I think you're confused. First of all I think you're confused as to what a class C network is, and second of all I think you're confused as to what networks are non-routable and what it

Re: wierd connection attempt

2002-03-15 Thread Noah L. Meyerhans
On Fri, Mar 15, 2002 at 06:40:45AM -0500, Josh Frick wrote: > > > I thought class C networks were non-routable. I think you're confused. First of all I think you're confused as to what a class C network is, and second of all I think you're confused as to what networks are non-routable and what i

Re: wierd connection attempt

2002-03-15 Thread Josh Frick
Stephen Gran wrote: This one time, at band camp, Hal said: I run a potato server on an ethernet behind a firewall connected by dsl to the internet. The only service exposed is ftp, In the middle of last night ippl reported an ftp connection attempt from 192.168.1,1 The network behind my

Re: wierd connection attempt

2002-03-15 Thread Josh Frick
Stephen Gran wrote: >This one time, at band camp, Hal said: > >>I run a potato server on an ethernet behind a firewall connected by dsl to the >internet. The only service exposed is ftp, In the middle of last night ippl >reported an ftp connection attempt from 192.168.1,1 The network behind

zlib && MALLOC_CHECK

2002-03-15 Thread Thomas Braun
Hi Group, ist there someone who is using the MALLOC_CHECK environment variables? How is the Performance? cu thomas -- Thomas Braun WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 [EMAIL PROTECTED] Internet & Security for ProfessionalsFax 0241/911879 WESTEND ist C

zlib && MALLOC_CHECK

2002-03-15 Thread Thomas Braun
Hi Group, ist there someone who is using the MALLOC_CHECK environment variables? How is the Performance? cu thomas -- Thomas Braun WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 [EMAIL PROTECTED] Internet & Security for ProfessionalsFax 0241/911879 WESTEND ist