Mailinglist Archive: opensuse-security (465 mails)

< Previous Next >
Re: [suse-security] Re: ICMP
  • From: "john" <johnvd@xxxxxxxxx>
  • Date: Sat, 29 Dec 2001 12:27:25 +0100
  • Message-id: <000801c1905b$caa7c1e0$9600000a@xxxxxxxxx>
Some more info from dmesg :

eth0: PCnet/PCI 79C970 at 0x7000, 00 80 5f 5a 1d 17 assigned IRQ 3.
pcnet32.c:v1.25kf 26.9.1999 tsbogend@xxxxxxxxxxxxxxxx
eth1: 3c509 at 0x300 tag 1, 10baseT port, address 00 60 97 e4 95 53, IRQ
10. <<<!!!!
3c509.c:1.16 (2.2) 2/3/98 becker@xxxxxxxxxxxxxxxxxxxxx <<<<!!!!
VFS: Mounted root (ext2 filesystem) readonly.
change_root: old root has d_count=1
Trying to unmount old root ... okay
Freeing unused kernel memory: 68k freed
Adding Swap: 32092k swap-space (priority -1)
Serial driver version 4.27 with HUB-6 MANY_PORTS MULTIPORT SHARE_IRQ enabled
ttyS00 at 0x03f8 (irq = 4) is a 16550A
eth1: Setting Rx mode to 1 addresses. <<<!!!

So, eth1 is a 3C509 and here it says IRQ10, but IRQ 10 is taken up by the
SCSI controller.
I assign IRQ9 to eth1 later on (should be done via initrd, I believe) :

modules.conf:options 3c509 irq=9

But I also have :
conf.modules:options 3c509 irq=9

which one is the right one (conf.modules/modules.conf???)

Thanks again,
JohnvD.




----- Original Message -----
From: Johannes Marloth <johannes.marloth@xxxxxxxxxxx>
To: <suse-security@xxxxxxxx>
Sent: Saturday, December 29, 2001 8:30 AM
Subject: [suse-security] Re: ICMP


> Hi JohnvD and all other,
>
> > kernel: IP_MASQ:reverse ICMP: failed checksum from 195.64.6.130!
>
> I'd like to know if 195.64.6.130 is your IP? Surely?!
>
> > Dec 28 00:10:33 zwiffelzwaffel kernel: IP_MASQ:reverse ICMP: failed
> checksum from 213.7.32.37!
>
> It seems that your masquerading fails for 213.7.32.37. Another point
> can be the masquerading and/or forwarding set (misconfigured?). Maybe
> also an attack is possible....
> But if I read:
>
> > Dec 28 12:17:51 zwiffelzwaffel kernel: eth1: Setting Rx mode to 1
> addresses.
>
> Two years ago (something around this :) i got the same message and
> after five days the nic 'died'....
>
> Perhaps try to deactivate all unnecessary masquerading modules &
> rules. If you have another netcard, maybe the replacement works...
>
> Hope you get it solved,
> Johannes
>
>
> --
> To unsubscribe, e-mail: suse-security-unsubscribe@xxxxxxxx
> For additional commands, e-mail: suse-security-help@xxxxxxxx
>


< Previous Next >
References