On Wed, Jul 10, 2002 at 02:08:01PM -0000, [EMAIL PROTECTED] wrote:
> When I do a nslookup "ipaddress" it says: Non-existent domain. Strange isnt't
> it???
Not really.
Just as a guess, you probably got scanned as soon as you booted
up and you probably have a couple of services like smtp, http, or such
that are running. You didn't say what distro version you were running
or if you had any services or firewalling enabled. You also didn't say
what ports they were connecting to or what the connection state was.
As far as the ARP table goes, the remote addresses are probably
not on your subnet, so the ARP table shows the default gateway mac
address or the address of some proxy-arp gateway between you and them.
Hard to tell without knowing what your network topology is.
As far as the nslookup goes, they don't have a reverse
DNS entry. Again... Not strange at all. Unfortunately, rather
common.
Beyond that, without seeing the netstat output with those
remote addresses and not knowing the local ports and your local address
or your interface configuration or the arp table information or any
of the rest of the nice information you should have provided that would
help us have a clue what you are seeing, it's impossible to tell what
those addresses were connecting to and if they were on your same subnet
or not.
But in the current environment of almost continual portscanning
and worm propagation... No, it's not strange or even particularly
surprising. Actually pretty common and understandable. Unfortunately...
> Patrick
Mike
> On Wed, 10 Jul 2002 10:02:33 -0400 "Jonathan M. Slivko"
> <[EMAIL PROTECTED]> wrote:
> >Is this a home machine or a work server?
> >-- Jonathan
> >
> >> Hi all,
> >>
> >> I think or I am going crazy or I am too stupid too understand this
> >one. Check
> >> it out: After my computer is restarted I connect to the Internet, but
> >I don't
> >> establish any connection yet to any site. Now, I do a netstat -pan and
> >see 4
> >> external ip-addresses.!! How is this possible?? When I do a arp -a I
> >get 6
> >> different ip-addresses with all the same mac-address!!. What the What
> >is going
> >> on here?????? Thanx in advance,
> >>
> >>
> >> patrick
> >>
> >>
> >>
> >> _______________________________________________
> >> Redhat-list mailing list
> >> [EMAIL PROTECTED]
> >> https://listman.redhat.com/mailman/listinfo/redhat-list
> >>
> >>
> >
> >--
> >Jonathan M. Slivko <[EMAIL PROTECTED]>
> >Systems Administrator - ClickNet Solutions, Inc.
> >web: http://www.clicknetsolutions.com/
> >
> >
> >
> >_______________________________________________
> >Redhat-list mailing list
> >[EMAIL PROTECTED]
> >https://listman.redhat.com/mailman/listinfo/redhat-list
> >
>
>
>
> _______________________________________________
> Redhat-list mailing list
> [EMAIL PROTECTED]
> https://listman.redhat.com/mailman/listinfo/redhat-list
--
Michael H. Warfield | (770) 985-6132 | [EMAIL PROTECTED]
/\/\|=mhw=|\/\/ | (678) 463-0932 | http://www.wittsend.com/mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
