Gretts * I came home today to my box noticing that a large number of httpd processes being spawned (this isn't a server, at least not really), and for the last hours or so my box is real slow when it comes to using the net.
I'm on a DSL line and am getting some errors connecting to sites and such. I installed tcpdump and am getting lines like: 17:57:50.710986 210.95.36.130.4156 > m206-157.dsl.tsoft.com.4156: udp 41 (DF) 17:57:50.711030 m206-157.dsl.tsoft.com > 210.95.36.130: icmp: m206-157.dsl.tsoft.com udp port 4156 unreachable [tos 0xc0] 17:57:50.737316 158.182.6.120.4156 > m206-157.dsl.tsoft.com.4156: udp 41 (DF) 17:57:50.737361 m206-157.dsl.tsoft.com > 158.182.6.120: icmp: m206-157.dsl.tsoft.com udp port 4156 unreachable [tos 0xc0] 17:57:50.742490 How can I fix this? If it's a "ping storm" how do I stop it? I figure it has something to do with iptables but I'm a real newbie where this type of thing is concerned. After looking at tcpdump for a few minutes it is not apparent that a single site is trying to connect, but a large number of different sites. They all have one thing in common, though, this port 4156. I also noticed when looking in /var/log a couple of lines that look specifically like breakin attempts within the last week... Sep 16 19:17:04 m206-157 rpc.statd[1008]: gethostbyname error for ^X���^X���^Y�� �^Y���^Z���^Z���^[���^[���%8x%8x%8x%8x%8x%8x%8x%8x%8x%236x%n%137x%n%10x%n%192x%n \220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220 etc... that is very suspicious - that looks like an exploit. Between 9/16 and today nothing suspicious; there is always the lone ftp or nntp attempt but they fail and it doesn't impact performance. But today, it's like someone is flood pinging my device - the net lights are constantly on. I also saw this today: Sep 21 10:03:59 m206-157 kernel: Neighbour table overflow. Sep 21 10:03:59 m206-157 last message repeated 9 times Sep 21 10:04:04 m206-157 kernel: NET: 3050 messages suppressed. Sep 21 10:04:04 m206-157 kernel: Neighbour table overflow. Sep 21 10:04:09 m206-157 kernel: NET: 8192 messages suppressed. Sep 21 10:04:09 m206-157 kernel: Neighbour table overflow. Sep 21 10:04:14 m206-157 kernel: NET: 7009 messages suppressed. Sep 21 10:04:14 m206-157 kernel: Neighbour table overflow.
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
