🚀 go-pugleaf

RainbowHat wrote:
> 
> < Zebee Johnstone
> >In aus.computers.linux on Mon, 27 May 2002 06:50:40 +0800
> >Graham Daniell <gdaniell@wt.com.au> wrote:
> >>
> >>May 26 20:49:41 torvalds network: Bringing up route unknown
> >>succeeded
> >>May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
> >
> >>It looks to me like someone managed to install a route between my
> >>internal network and an unknown address (probably 195.119.1.180?)
> >
> >Doesn't make sense to me.  eth0 isn't a route, it's a network
> >interface...
> 
> Please try the following commands.
> 

> nslookup unknown
Output:
[root@torvalds /root]# nslookup unknown
Server:  bilby.wn.com.au
Address:  203.10.1.17
*** bilby.wn.com.au can't find unknown: Non-existent host/domain
(bilby is my ISP's box (proxy?))


> nslookup eth0
[root@torvalds /root]# nslookup eth0
Server:  bilby.wn.com.au
Address:  203.10.1.17
*** bilby.wn.com.au can't find eth0: Non-existent host/domain


> nslookup eth1
[root@torvalds /root]# nslookup eth1
Server:  bilby.wn.com.au
Address:  203.10.1.17
*** bilby.wn.com.au can't find eth1: Non-existent host/domain


> nslookup 195.119.1.180          # at _your_ box
[root@torvalds /root]# nslookup 195.119.1.180
Server:  bilby.wn.com.au
Address:  203.10.1.17
Name:    open.proxy.austnet.org
Address:  195.119.1.180



> nslookup open.proxy.austnet.org
[root@torvalds /root]# nslookup open.proxy.austnet.org
Server:  bilby.wn.com.au
Address:  203.10.1.17
Name:    open.proxy.austnet.org
Address:  195.119.1.180



> nslookup localhost
[root@torvalds /root]# nslookup localhost
Server:  bilby.wn.com.au
Address:  203.10.1.17
*** bilby.wn.com.au can't find localhost: Non-existent host/domain


 
> egrep -in '(unknown|eth(0|1))' /etc/hosts* /etc/named*
[root@torvalds /root]# egrep -in '(unknown|eth(0|1))' /etc/hosts*
/etc/named*
[root@torvalds /root]#


 
> cat /etc/host.conf /etc/resolv.conf
[root@torvalds /root]# cat /etc/host.conf /etc/resolv.conf
order hosts,bind
multi on
search localdomain
nameserver 203.10.1.17
nameserver 203.10.1.9
[root@torvalds /root]#


 
> su
> egrep -in '(route|unknown|eth(0|1))' ~/.*history
[root@torvalds /root]# egrep -in '(route|unknown|eth(0|1))' ~/.*history
978:cat secure* | grep route
988:cat messages* | grep route
989:cat messages* | grep route | less
[root@torvalds /root]#

(the above entries are mine, searching for these strings in my logs)



> echo $HOSTALIASES $LOCALDOMAIN
[root@torvalds /root]# echo $HOSTALIASES $LOCALDOMAIN

[root@torvalds /root]#

(any significance in the <blank line> in the above?)


> 
> Which IRC client are you using on Windoze9x or Linux? Obsolete `mIRC`
> have a vulnerability (search bugtraq).
My son is using mIRC, v 6.01
(appears to be the latest ver?)



> 
> 8< (Summary: lsof -i, netstat -rn, ps)

- pardon?  (what is the above?)



> 
> --
> Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
> ----+----1----+----2----+----3----+----4----+----5----+----6----+----7


Thank you for your reply, it has given me something to think about.  I
think I get the drift of what the above commands are doing, looking for
something amis, and the outputs above seem to look innocuous to me.  How
about to you?

Thanks,
Graham Daniell