Mailinglist Archive: opensuse-security (334 mails)

< Previous Next >
Re: [suse-security] martian source messages
  • From: "Pep Serrano" <mylists@xxxxxxxxxxxxxxxxxxxx>
  • Date: Thu, 18 Sep 2003 10:23:01 +0200
  • Message-id: <001701c37dbe$13c1c4b0$a32e8a89@xxxxxxx>
But is this the real cause of our martian logs?


> On Sep 18, Roland Freeman <rolandfreeman@xxxxxxxxx> wrote:
> > Pep, we have the same problem. My P-t-P router has a private ip address
> > too. Everything works properly, except the marsians log.

> A private IP address as gateway is not necessarily a problem. ISP's use
> this to save IP addresses and it is in no way bad for anyone. As long as
> they are not used in the route back to you, which isn't the case as you
> stated.


Last night I spent some time with ethereal tracking my traffic between the
loopback and my ppp0. I could see there are some packets from localhost on
port 80 to random ports of ppp0. This packet repeats abour every minute. I
closed almost all services, disabled routing, no applications... lsof didn't
show any process using localhost:80, and yet the werid traffic was still
there.


Cheers
Pep Serrano.


< Previous Next >