🚀 go-pugleaf

Tim Haynes wrote:
> 
> Simon Waters <Simon@wretched.demon.co.uk> writes:
> 
> > I seem to have a ppp connection hang after probes from Korean IP
> > addresses to port 111. No other packets were logged - doesn't mean there
> > weren't any!
> 
> If your firewall was up to scratch, you'd *know* there weren't any because
> you'd be denying & logging everything by default.

We aren't logging the accepted ones.

> It should never have been installed in the first place. (Korea, that is,
> as well as portmapper.)

Agree about portmapper - I've never been to Korea so couldn't comment.

> > Anyone know what aspect of this scan/attack causes the hang?
> 
> Nothing normally does. What you don't say is how much activity there is
> after it's `hung'. You also don't say whether you're getting any malformed
> packets, fragmentation problems, or what.

Nothing is complaining. None of the other firewall rules logging diddly,
although presumably I should kick it harder as they must be doing some
sort of scan to find the filtered 111. 
 
> > I see no evidence that the box was compromised, so I assume
> 
> Have you run chkrootkit? Had a look in /etc/{inittab,inetd.conf} and
> /dev/.lib and /var/named? Run an rpm -Vva? Monitored your network
> connections with e.g. iptraf to see what's going where? Checked your
> outgoing firewall logs?

All those are as expected - no I hadn't run chkrootkit.
 
> Consider what would happen if your box was port-scanning a large (/16)
> network block over your modem and then you bounced ppp0; I'd expect an
> overclogged connection that would appear like it's hung, and then maybe the
> process/es responsible would die after the interface was downed.

Appreciated - there was no evidence of any traffic on the interface when
it appears hung. So if there is the kernel is lying to me and it hadn't
rebooted so I think it is probably trustworthy.
 
> In short, you're home but not even vigorously towelling off yet.

Appreciated. It'll get reinstalled shortly.

But I still want to track down what caused the hang.

Should have said Kernel 2.2.17, portmap appears to have been receiving
TCP packets but not UDP on Port 111, stray attacks against port 111 like
this seen before, all from Korea. portmap-4.0-17 

-- 
Want to learn about Linux? Get it installed?
Devon and Cornwall LUG Event for UK Linux Day 
Exeter University - Sunday April 29th 2001 10:00 to 17:00
www.linuxday.org.uk or join D&C LUG www.lug.termisoc.org