Re: IP Spoofing?

From: Matt Hess (mhess@POWER.DYNASTY.NET)
Date: 03/04/98


hmm, try upgrading the kernel
I went from a 2.0.28 redhat kernel to a 2.0.31 and it went away
don't know if that helps or not..
oh well


On Wed, 4 Mar 1998, John Evans wrote:

> I have the following three lines in my logs:
>
> Mar  3 20:05:02 :: New connection from [017.255.020.000]
> process_input: about to lose connection: No route to host
> Mar  3 20:05:02 :: Losing descriptor without char.
>
> These lines repeat approx. 30 times and are spaced from 3 to 35 seconds
> apart. The two IPs involved are 017.255.020.000 and 086.221.006.008
>
> I'm not sure if they are even valid IPs, but I checked the logs about 2
> minutes after these connection attempts were made. I tried to ping those
> IPs, and got nothing back at all. nslookup shows nothing on the IPs
> either (but that doesn't mean a whole lot.)
>
> The only changes that I have made to the connection procress is Eric
> Green's ident code and some (ok, several) new CON_* states. My MUD is not
> public at the moment as we are still building the world and in the latter
> stages of code development. The only people that know the IP/Port of my
> MUD are my staff and the admin of the MUD host.
>
> Any ideas about what may be happening?
>
> Thanks for any insight that you have to shed on this matter.
>
> John Evans <evansj@hi-line.net>  --  http://www.hi-line.net/~evansj/
>
> Any sufficiently advanced technology is indistinguishable from magic.
> --Arthur C. Clarke
>
>
>      +------------------------------------------------------------+
>      | Ensure that you have read the CircleMUD Mailing List FAQ:  |
>      | http://democracy.queensu.ca/~fletcher/Circle/list-faq.html |
>      +------------------------------------------------------------+
>


     +------------------------------------------------------------+
     | Ensure that you have read the CircleMUD Mailing List FAQ:  |
     | http://democracy.queensu.ca/~fletcher/Circle/list-faq.html |
     +------------------------------------------------------------+



This archive was generated by hypermail 2b30 : 12/15/00 PST