ppp hanging due to irritating Korean school kids

Article View: uk.comp.os.linux

Article #117

#117

From: Simon Waters
Date: Wed, 25 Apr 2001 14:06

27 lines
2187 bytes

Hi,

I seem to have a ppp connection hang after probes from Korean IP
addresses to port 111. No other packets were logged - doesn't mean there
weren't any!

Several dozen log entries turn up as follows....

Apr 25 11:55:54 linux1 kernel: Packet log: input DENY ppp0 PROTO=17
211.39.194.151:742 a.b.c.d:111 L=84 S=0x00 I=65452 F=0x0000 T=44
(#7)        

I have tightened the ipchains rules, and zapped portmapper from the box
(I'm fairly sure nothing needed it *8)

Anyone know what aspect of this scan/attack causes the hang?

I see no evidence that the box was compromised, so I assume that the
scan is just causing the interface to hang before anything nastier.
Stopping and starting the ppp interface restores connectivity.

	Simon
-- 
Want to learn about Linux? Get it installed?
Devon and Cornwall LUG Event for UK Linux Day 
Exeter University - Sunday April 29th 2001 10:00 to 17:00
www.linuxday.org.uk or join D&C LUG www.lug.termisoc.org

Technical Details

Message-ID: <3AE6D9DD.C739A284@wretched.demon.co.uk>

Path:

arc1-ca.pugleaf.net!newsfeed.google.com!newsfeed.stanford.edu!news.tele.dk!195.224.53.60!nntp.news.xara.net!xara.net!gxn.net!dispose.news.demon.net!news.demon.co.uk!demon!wretched.demon.co.uk!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10d8ad,4403abd1862fb11f,start
X-Google-Attributes: gid10d8ad,public
X-Google-Thread: 108f6a,4403abd1862fb11f,start
X-Google-Attributes: gid108f6a,public
X-Google-ArrivalTime: 2001-04-25 07:05:01 PST
Path: arc1-ca.pugleaf.net!newsfeed.google.com!newsfeed.stanford.edu!news.tele.dk!195.224.53.60!nntp.news.xara.net!xara.net!gxn.net!dispose.news.demon.net!news.demon.co.uk!demon!wretched.demon.co.uk!not-for-mail
From: Simon Waters <Simon@wretched.demon.co.uk>
Newsgroups: uk.comp.os.linux,demon.ip.support.unix
Subject: ppp hanging due to irritating Korean school kids
Date: Wed, 25 Apr 2001 15:06:21 +0100
Organization: Eighth Layer Limited
Message-ID: <3AE6D9DD.C739A284@wretched.demon.co.uk>
Reply-To: Simon@wretched.demon.co.uk
NNTP-Posting-Host: wretched.demon.co.uk
X-NNTP-Posting-Host: wretched.demon.co.uk:193.237.109.203
X-Trace: news.demon.co.uk 988207496 nnrp-08:3513 NO-IDENT wretched.demon.co.uk:193.237.109.203
X-Complaints-To: abuse@demon.net
X-Mailer: Mozilla 4.61 [en] (X11; I; Linux 2.2.17 i686)
X-Accept-Language: en-GB, en-US, en
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 27