Re: IP Spoofing?

From: George (greerga@CIRCLEMUD.ORG)
Date: 03/04/98


On Wed, 4 Mar 1998, John Evans wrote:

>Mar  3 20:05:02 :: New connection from [017.255.020.000]
>process_input: about to lose connection: No route to host
>Mar  3 20:05:02 :: Losing descriptor without char.
[..]
>I'm not sure if they are even valid IPs, but I checked the logs about 2
>minutes after these connection attempts were made. I tried to ping those
>IPs, and got nothing back at all. nslookup shows nothing on the IPs
>either (but that doesn't mean a whole lot.)

It's a Linux 'feature'.

>Any ideas about what may be happening?

If the client disconnects between the accept() and the structure is read,
you will get random (and usually invalid) IP addresses.

--
George Greer  -  Me@Null.net   | Genius may have its limitations, but stupidity
http://www.van.ml.org/~greerga | is not thus handicapped. -- Elbert Hubbard


     +------------------------------------------------------------+
     | Ensure that you have read the CircleMUD Mailing List FAQ:  |
     | http://democracy.queensu.ca/~fletcher/Circle/list-faq.html |
     +------------------------------------------------------------+



This archive was generated by hypermail 2b30 : 12/15/00 PST