* Karsten M. Self ([email protected]) spake thusly: > on Thu, Dec 27, 2001 at 11:35:37PM -0600, shock ([EMAIL PROTECTED]) wrote: > > I keep getting the following in my log file: > > > > Dec 27 23:17:00 exitwound sshd2[3771]: X11 connection from > > 192.168.9.1:3367 (server01.exitwound.org) > > > > Does anyone have some idea as to what this is? It started showing up > > about 3 days ago. > > If that's not a system on your local network, then it appears that > someone's spoofing local IPs to try connecting to your system. > 196.168.*.* should be nonrouteable. A firewall will block these > connections.
192.168.9.1 is a local system, and it's the system from which the log messages are originating. it's very odd, because it happens fairly often, it's quite random. i haven't been able to track it down..... -- ____) ,_) ,_) (-(__ |_ _ _ |/ ____) | |(_)(_ |\ ( \_, _______________________________________________ | http://www.exitwound.org : hard to find | _______________________________________________ | Alex Haley was adopted! | _______________________________________________ -------------BEGIN GEEK CODE BLOCK------------- | Version: 3.1 | | GJ/IT d- s: a C+++>$ UL++++ P+++ L+++ E--- W++| | N+@ o K- w O- M- V PS+ PE Y+ PGP++ t+@ 5@ X++ | | R tv+@ b+ DI++++ D+ G++ e++++ h---- r+++ y+++ | --------------END GEEK CODE BLOCK--------------
