Re: ppp hanging due to irritating Korean school kids

Article View: uk.comp.os.linux

Article #109

#109

From: Simon Waters
Date: Sat, 28 Apr 2001 11:42

33 lines
2453 bytes

Nick Drage wrote:
> 
> .kr != Korea

Urm kr = People Republic of Korea, unless something changed. Anyway the
addresses I see this from are a Korean school and a Korean ISP dial up.

> And the portmapper... yes, shouldn't be ran by default.

Agreed.

> >> Anyone know what aspect of this scan/attack causes the hang?
> 
> Yes, first time I've heard anyone complain about this - what do your
> PPP logs say ( /var/log/debug ? )

I don't run PPP debug. Absolutely nothing logged apart from the IPChain
denies on 111.

> Er... this connections were all inbound weren't they?  What logical
> step did I miss?

He was just implying that if the box was hacked and being used to attack
others (There isn't much of value to anyone else on it - even the
software is all freely available) then it might appear to hang the
Internet connection. But there isn't even a hint of anything being
compromised.

-- 
Want to learn about Linux? Get it installed?
Devon and Cornwall LUG Event for UK Linux Day 
Exeter University - Sunday April 29th 2001 10:00 to 17:00
www.linuxday.org.uk or join D&C LUG www.lug.termisoc.org

Technical Details

Message-ID: <3AEAACB0.B43D10E8@wretched.demon.co.uk>

Path:

arc1-ca.pugleaf.net!newsfeed.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!dispose.news.demon.net!news.demon.co.uk!demon!wretched.demon.co.uk!not-for-mail

References: <3AE6D9DD.C739A284@wretched.demon.co.uk> <87k8492h4q.fsf@storm.emcuk.com> <3ae9c8a6.2152815@news.demon.co.uk>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 108f6a,4403abd1862fb11f
X-Google-Attributes: gid108f6a,public
X-Google-Thread: 10d8ad,4403abd1862fb11f
X-Google-Attributes: gid10d8ad,public
X-Google-ArrivalTime: 2001-04-28 04:42:01 PST
Path: arc1-ca.pugleaf.net!newsfeed.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!dispose.news.demon.net!news.demon.co.uk!demon!wretched.demon.co.uk!not-for-mail
From: Simon Waters <Simon@wretched.demon.co.uk>
Newsgroups: uk.comp.os.linux,demon.ip.support.unix
Subject: Re: ppp hanging due to irritating Korean school kids
Date: Sat, 28 Apr 2001 12:42:40 +0100
Organization: Eighth Layer Limited
Message-ID: <3AEAACB0.B43D10E8@wretched.demon.co.uk>
References: <3AE6D9DD.C739A284@wretched.demon.co.uk> <87k8492h4q.fsf@storm.emcuk.com> <3ae9c8a6.2152815@news.demon.co.uk>
Reply-To: Simon@wretched.demon.co.uk
NNTP-Posting-Host: wretched.demon.co.uk
X-NNTP-Posting-Host: wretched.demon.co.uk:193.237.109.203
X-Trace: news.demon.co.uk 988458072 nnrp-09:18725 NO-IDENT wretched.demon.co.uk:193.237.109.203
X-Complaints-To: abuse@demon.net
X-Mailer: Mozilla 4.61 [en] (X11; I; Linux 2.2.17 i686)
X-Accept-Language: en-GB, en-US, en
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 33

Reply to Parent Message