On Tuesday 30 July 2002 1:48 pm, you wrote:
Hi Susers
I just checked my log and noticed the following
"...eth0: Promicous mode enabled ... eth0: device eth0 entered promiscous mode ..eth0: device eth0 left promiscous mode"
inbetween entered and left promiscous mode I can see that a client has accessed his pop account.
It means the ethernet card has been switched to a mode where it accepts all packets from the network, not just those destined for the actual card. The mode is used by the "good guys" for network monitoring, and by the "bad guys" for packet sniffing. I can't imagine why an app which accesses a pop account should want to go into promiscous mode, but someone might have an idea.
Have I been hacked?
Probably not, but your machine might have been used for a network sniff. You're right to be suspicious. At the lab where I am now, unauthorised setting of a network card on the company LAN to promiscous mode is a disciplinary offence. -- 12:01pm up 6 days, 2:41, 1 user, load average: 0.09, 0.04, 0.03