🚀 go-pugleaf

On 25 Apr 2001 15:23:01 +0100, Tim Haynes
<piglet@stirfried.vegetable.org.uk> wrote:
>Simon Waters <Simon@wretched.demon.co.uk> writes:

<snip>

>> Several dozen log entries turn up as follows....
>> 
>> Apr 25 11:55:54 linux1 kernel: Packet log: input DENY ppp0 PROTO=17
>> 211.39.194.151:742 a.b.c.d:111 L=84 S=0x00 I=65452 F=0x0000 T=44
>> (#7)        
>> 
>> I have tightened the ipchains rules, and zapped portmapper from the box
>> (I'm fairly sure nothing needed it *8)
>
>It should never have been installed in the first place. (Korea, that is,
>as well as portmapper.)

.kr != Korea

And the portmapper... yes, shouldn't be ran by default.

>> Anyone know what aspect of this scan/attack causes the hang?
>
>Nothing normally does. What you don't say is how much activity there is
>after it's `hung'. You also don't say whether you're getting any malformed
>packets, fragmentation problems, or what.

Yes, first time I've heard anyone complain about this - what do your
PPP logs say ( /var/log/debug ? )

>> I see no evidence that the box was compromised, so I assume
>
>Have you run chkrootkit? Had a look in /etc/{inittab,inetd.conf} and
>/dev/.lib and /var/named? Run an rpm -Vva? Monitored your network
>connections with e.g. iptraf to see what's going where? Checked your
>outgoing firewall logs?

"iptraf" ?

>> that the scan is just causing the interface to hang before anything
>> nastier. Stopping and starting the ppp interface restores connectivity.
>
>Consider what would happen if your box was port-scanning a large (/16)
>network block over your modem and then you bounced ppp0; I'd expect an
>overclogged connection that would appear like it's hung, and then maybe the
>process/es responsible would die after the interface was downed.

Er... this connections were all inbound weren't they?  What logical
step did I miss?

>In short, you're home but not even vigorously towelling off yet.

Now there's a phrase to remember :)

-- 
"Analogies generally suck."
David Taylor