One could think of some hacker that uses ifconfig to set up a virtual interface in order to use that with IRC bots or the like, but the problem here is that IPs which are off your netblock (given that you have a network with public IP addresses) are generally not routed to you, therefore it would be completely useless to set up such interface; one could not use it to connect to anywhere. Usually one can not even send out packets from a IP that is not inside the site's official netblock since most ISPs are now performing egress filtering on theyre border routers, allowing only traffic to pass to the outside that originates from the ISP's assigned IP range. Cheers Chris .-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^ |--------+-----------------------> | | Markus Kohli | | | <markus@webde| | | ko.com> | | | | | | 17.06.2002 | | | 10:07 | | | | |--------+----------------------->

--------------------------------------------------------------------------------------------------------------------------| | | | An: suse-security@suse.com | | Kopie: "Stefan Nauber" <stefan.nauber@cs2-informatik.de> | | Thema: Re: [suse-security] unknown network interface showed up suddenly | --------------------------------------------------------------------------------------------------------------------------|

I'd bet it was some "sit 6" interface, or something like this. Showed up on my laptop once, too. In my case it was related to an SSH-tunnel I had openend. Could that match your case, too? I just don't think some remote attacker installed a new interface... Doesn't make to much sense IMO.

Greetz

Markus