🚀 go-pugleaf

nickd@nospam.demon.co.uk (Nick Drage) writes:

> >> Apr 25 11:55:54 linux1 kernel: Packet log: input DENY ppp0 PROTO=17
> >> 211.39.194.151:742 a.b.c.d:111 L=84 S=0x00 I=65452 F=0x0000 T=44
> >> (#7)        
> >> 
> >> I have tightened the ipchains rules, and zapped portmapper from the
> >> box (I'm fairly sure nothing needed it *8)
> >
> >It should never have been installed in the first place. (Korea, that is,
> >as well as portmapper.)
> 
> .kr != Korea

You sure? (Not that it has much relevance anyway, but also consider:

  | person:      Seung-Min Lee
  | address:     Korea Network Information Center (KRNIC)
  | address:     **************** Important Notice **********************
  | address:     KRNIC is the National Internet Registry
  | address:     If you want to find detail assignment information
  | address:     about above IP address, please use "http://whois.nic.or.kr"
  | address:     *****************************************************
  | address:     Narajongkeum B/D 14F, 1328-3, Seocho-dong, Seocho-Ku
  | address:     Seoul, 137-070, Republic of Korea
  | country:     KR
  | phone:       +82-2-2186-4500
  | fax-no:      +82-2-2186-4496
  | e-mail:      hostmaster@nic.or.kr
  | nic-hdl:     SL119-AP
  | mnt-by:      MNT-KRNIC-AP
  | changed:     hostmaster@nic.or.kr 20000927
  | source:      APNIC
)

> >Nothing normally does. What you don't say is how much activity there is
> >after it's `hung'. You also don't say whether you're getting any
> >malformed packets, fragmentation problems, or what.
> 
> Yes, first time I've heard anyone complain about this - what do your
> PPP logs say ( /var/log/debug ? )

I'm thinking it would also be a good idea to run pppd in maximum debug mode
- `kdebug 25' (or 81?) and get the contents of every packet. I wonder if
the modem is so misconfigured as to be mishandling an `ATH' coming down?

> >Have you run chkrootkit? Had a look in /etc/{inittab,inetd.conf} and
> >/dev/.lib and /var/named? Run an rpm -Vva? Monitored your network
> >connections with e.g. iptraf to see what's going where? Checked your
> >outgoing firewall logs?
> 
> "iptraf" ?

Nope, just iptraf will do nicely. <http://rpmfind.net/> is your fwend(TM).

> >Consider what would happen if your box was port-scanning a large (/16)
> >network block over your modem and then you bounced ppp0; I'd expect an
> >overclogged connection that would appear like it's hung, and then maybe
> >the process/es responsible would die after the interface was downed.
> 
> Er... this connections were all inbound weren't they? What logical step
> did I miss?

If you've been cracked, thre's a large chance you're scanning /16 blocks of
network at random for similar things - 1i0n and ramen (and adore?) all do
this. If you're getting a largre amount of packets and you suddenly become
`destination-unreachable', might not the process also go away if it's
remote?

> >In short, you're home but not even vigorously towelling off yet.
> 
> Now there's a phrase to remember :)

Based on an orignial by D Adams :8)

~Tim
-- 
   12:39:34 up 5 days,  2:05, 15 users,  load average: 0.09, 0.23, 0.31
piglet@stirfried.vegetable.org.uk  |Rushing onwards, tracing the chains,
http://piglet.is.dreaming.org      |Chasing the days, chasing the days.