My 2c worth , late but here.
I would think it is a nat problem. Firewalls, routers, IPCop ... can
rewrite the packet after capturing it and make it look like everything
is coming from you.
Was the IP address you are seeing the router, cable modem or your boxes
ip address? What ever address it is showing I would suspect that
hardware or the hardware next to it.
Also does your server log use some kind of resolution software and has
a wrong ip address attached to a mac address or name?
Shane
Andrew Errington wrote:
On Mon, 13 Jun 2005 10:29, you wrote:
I am on paradise at work and orcon at home. i am at work now. when i ssh
to home and then ssh back again it shows on my work machine that I logged
in from the ip address of my home machine.
Hmm. I don't know who our ISP at work it, but I don't think it's Paradise.
I also tried logging in from a machine in the UK. Same deal.
Both machines are behind ipcop.
when i log into the work machine from another box at work, it shows me
logging in from the 192.168.x.x address as it should.
Yes, I tried logging in to 192.168.2.24 from 192.168.2.24, and got the
correct IP address in the log. It seems that local numbers are correct,
but anything from outside is marked with the same IP address (my fixed IP).
so in short i am not experiencing this.
But I am curious: is the machine dorectly connected to the net or does
it go thru some sort of router/firewall/nat machine?
I have the Telstra cable modem, then a nat/router box (hardware thing, not
a PC-based thing).
Are you logging on from elsewhere on the lan, or from somewhere "out on
the net"?
I am logging in from outside. i.e. not on the lan.
Oh, and when I say "My IP address is hacking me!", what I mean is that all
the worms and viruses that are trying to have a go at my machine on port 22
now appear to be coming from my fixed IP address. This is what spooked me,
until I realised that *all* outside access (including legitimate access)
appears to be coming from my fixed IP address.
Andy
On Mon, 13 Jun 2005 10:09:15 +1200
Andrew Errington wrote:
Furthermore, whenever I log in with an ssh terminal session, I am told
my last login was from my own IP address, which I know not to be true.
Is this something to do with Paradise's 'tightening up' of security?
Anyone else noticed something similar?
Andy
--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.7.5/18 - Release Date: 15/06/2005
