Re: Strange route entry from China

2014-05-14 Thread Johan Beisser
On Wed, May 14, 2014 at 12:40 AM, Kevin Lyda wrote: > > On 14 May 2014 08:20, "Johan Beisser" wrote: >> >> On Tue, May 13, 2014 at 11:57 PM, Otto Moerbeek wrote: >> > >> > Op 14 mei 2014 om 07:48 heeft Johan Beisser het >> > volgende geschreven: >> > >> > There are more reasons dynamic route en

Re: Strange route entry from China

2014-05-14 Thread Kevin Lyda
On 14 May 2014 08:20, "Johan Beisser" wrote: > > On Tue, May 13, 2014 at 11:57 PM, Otto Moerbeek wrote: > > > > Op 14 mei 2014 om 07:48 heeft Johan Beisser het volgende geschreven: > > > > > > > There are more reasons dynamic route entries are createf. For example to record results of mtu path d

Re: Strange route entry from China

2014-05-14 Thread Johan Beisser
On Tue, May 13, 2014 at 11:57 PM, Otto Moerbeek wrote: > > Op 14 mei 2014 om 07:48 heeft Johan Beisser het volgende > geschreven: > > > There are more reasons dynamic route entries are createf. For example to > record results of mtu path discovery. That implies a successful TCP connection to

Re: Strange route entry from China

2014-05-14 Thread Otto Moerbeek
Op 14 mei 2014 om 07:48 heeft Johan Beisser het volgende geschreven: > On Tue, May 13, 2014 at 10:31 PM, Johan Ryberg wrote: >> Yes, it's related to a SSH brute force attack. >> >> I have just never seen the the "client" IP in the routing table before. My >> IP does not exist in the routing ta

Re: Strange route entry from China

2014-05-13 Thread Johan Beisser
On Tue, May 13, 2014 at 10:31 PM, Johan Ryberg wrote: > Yes, it's related to a SSH brute force attack. > > I have just never seen the the "client" IP in the routing table before. My > IP does not exist in the routing table when I SSH to the host. The IP shouldn't be there, at all. But, according

Re: Strange route entry from China

2014-05-13 Thread Johan Ryberg
Yes, it's related to a SSH brute force attack. I have just never seen the the "client" IP in the routing table before. My IP does not exist in the routing table when I SSH to the host. I have a hard time to understand the mechanism that added the IP to the table. Is this something that can be ex

Re: Strange route entry from China

2014-05-13 Thread Johan Beisser
>> On May 13, 2014, at 18:47, Stuart McMurray wrote: >> >> >> And, 163data.com.cn is a large source of shady activity. I blocked the bulk of China and Asia outright at the router. Quick solution, if not clean.

Re: Strange route entry from China

2014-05-13 Thread Stuart McMurray
On Tuesday, May 13, 2014, Amit Kulkarni wrote: > On Tue, May 13, 2014 at 3:27 PM, Johan Ryberg > > wrote: > > > Hi, > > > > Please forgive my ignorance. > > > > I have a small lab and I noticed this IP in the routing table: > > 61.174.51.232, resolves to > > 232.51.174.61.dial.wz.zj.dynamic.163da

Re: Strange route entry from China

2014-05-13 Thread Amit Kulkarni
On Tue, May 13, 2014 at 3:27 PM, Johan Ryberg wrote: > Hi, > > Please forgive my ignorance. > > I have a small lab and I noticed this IP in the routing table: > 61.174.51.232, resolves to > 232.51.174.61.dial.wz.zj.dynamic.163data.com.cn > > # route -n show > Routing tables > > Internet: > Destin

Strange route entry from China

2014-05-13 Thread Johan Ryberg
Hi, Please forgive my ignorance. I have a small lab and I noticed this IP in the routing table: 61.174.51.232, resolves to 232.51.174.61.dial.wz.zj.dynamic.163data.com.cn # route -n show Routing tables Internet: DestinationGatewayFlags Refs Use Mtu Prio Iface defau