- WLUG - wlug.mailman3.com

I hate crackers (not the kind you eat)

by Wesley Allen

OK, Looking at my log file from my firewall reveals that not I've got people trying to through my firewall from... 66.189.81.226 (and 246) (http connect attempts) 62.163.126.100 (same domain as yesterday) How do I track them back to the ISP's and send a message to their abuse@ address? Someone's trying to ping me from 66.189.24.226 as well. Am I being paranoid or could my isp be trying to crack my firewall to see if I've got any servers running? Time to batten down the hatches... Wes

April 18, 2002

Re: [Wlug] netbus attack...

by Phillip G Deneault

LOL, Netops has much better methods for annoying its users then using Netbus. :-) Wouldn't you agree Mike? :-) Phil On Wed, 17 Apr 2002, Michael Frysinger wrote: > dont let netops confuse you, its coming from them :/ > -mike > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Phil Deneault "We work in the dark, We do what we can, deneault(a)wpi.edu We give what we have. Our doubt is our passion, WPI NetOps and our passion is our task. The rest is the OpenVMS Guy maddness of art." - Henry James -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

April 17, 2002

Re: [Wlug] netbus attack...

by Michael Frysinger

dont let netops confuse you, its coming from them :/ -mike ----- Original Message ----- From: "Wesley Allen" <wallen(a)charter.net> To: <wlug(a)mail.wlug.org> Sent: Wednesday, April 17, 2002 12:51 Subject: [Wlug] netbus attack... > Hi, my firewall is detecting a "netbus attack" from an external source. > Anyway I can basically refuse connections? Nothing's gotten through > yet, but it's a pain to see someone doing it and I'd like to smack them > around a bit. Any ideas? > > Wes > > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

April 17, 2002

Re: [Wlug] netbus attack...

by Chuck Haines

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iptable -A INPUT -s IPOFATTACK -j DROP On 17 Apr 2002, Wesley Allen wrote: > Hi, my firewall is detecting a "netbus attack" from an external source. > Anyway I can basically refuse connections? Nothing's gotten through > yet, but it's a pain to see someone doing it and I'd like to smack them > around a bit. Any ideas? > > Wes > > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > - ---------------------------------------------- | Chuck Haines | AOL: CyberGrex | | GDC Webmaster | ICQ: 3707881 | | WPILA Lab Manager | Yahoo: CyberGrex_27 | | http://gdc.wpi.edu | MSN: CyberGrex | - ---------------------------------------------- "Geek by nature, Linux by choice." -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (OSF1) Comment: For info see http://www.gnupg.org iD8DBQE8vdFq7HPTHjUkyKwRAuq9AJ9GtulXC4x2rCIftAMfpcSrNX0vnACcCxZA O8jItcQM8R0BHfEZE9yhYWg= =N7JM -----END PGP SIGNATURE-----

April 17, 2002

Re: [Wlug] netbus attack...

by Wesley Allen

Ahh, yes, that's a good one. Wes On ed, 2002-04-17 at 12:56, Brian J. Conway wrote: > > Hi, my firewall is detecting a "netbus attack" from an external source. > > Anyway I can basically refuse connections? Nothing's gotten through > > yet, but it's a pain to see someone doing it and I'd like to smack them > > around a bit. Any ideas? > > It sounds like you already are refusing connections (or just dropping > the packets). If it looks like it's casual portscanning I'd just ignore > it. If it's coming from the same source constantly over a period of time, > send a nasty email to their provider's abuse@ address. =) > > -b > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

April 17, 2002

Re: [Wlug] netbus attack...

by Phillip G Deneault

And if its from a 130.215 address, please tell WPI Netops. We like to stop that kinda thing. :-) Phil On Wed, 17 Apr 2002, Brian J. Conway wrote: > > Hi, my firewall is detecting a "netbus attack" from an external source. > > Anyway I can basically refuse connections? Nothing's gotten through > > yet, but it's a pain to see someone doing it and I'd like to smack them > > around a bit. Any ideas? > > It sounds like you already are refusing connections (or just dropping > the packets). If it looks like it's casual portscanning I'd just ignore > it. If it's coming from the same source constantly over a period of time, > send a nasty email to their provider's abuse@ address. =) > > -b > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Phil Deneault "We work in the dark, We do what we can, deneault(a)wpi.edu We give what we have. Our doubt is our passion, WPI NetOps and our passion is our task. The rest is the OpenVMS Guy maddness of art." - Henry James -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

April 17, 2002

Re: [Wlug] netbus attack...

by Brian J. Conway

> Hi, my firewall is detecting a "netbus attack" from an external source. > Anyway I can basically refuse connections? Nothing's gotten through > yet, but it's a pain to see someone doing it and I'd like to smack them > around a bit. Any ideas? It sounds like you already are refusing connections (or just dropping the packets). If it looks like it's casual portscanning I'd just ignore it. If it's coming from the same source constantly over a period of time, send a nasty email to their provider's abuse@ address. =) -b

April 17, 2002

netbus attack...

by Wesley Allen

Hi, my firewall is detecting a "netbus attack" from an external source. Anyway I can basically refuse connections? Nothing's gotten through yet, but it's a pain to see someone doing it and I'd like to smack them around a bit. Any ideas? Wes

April 17, 2002

FOR SALE

by jeff

heya guys... times are tough...have to sell some stuff to stay afloat... so here goes... System A (workstation): HP Pavilion 8570C Pentium III 450 Mhz (Katmai) 192 MB Ram Voodoo 3/3000 Video Soundblaster Live! Value Linksys LNE100TX Ethernet 20 Gig Quantum Fireball IDE HD 32x CD-ROM HP CD-Writer Plus 8100 Series CDRW Floppy Cambridge Soundworks Desktop Speaker System (3-Way) HP Deskjet printer (no ink - very nice though) Samsung 753DF 17" monitor HP Internet Style Keyboard Logitech Firstmouse a little wear and tear but runs fine...have installed Win98SE and Mandrake/Red Hat/Debian several times with no problems... System B (router): Generic Case Doosey AMD K6-2 450 64 MB RAM Voodoo 3/2000 Video Soundblaster Live! Value 2X Netgear FA311 Ethernet 20 Gig Maxtor IDE HD No CDROM Floppy Desktop Speakers (generic) Visio (oldie) 15" color monitor same deal...a little wear and tear...but it's still up and running...i think uname -a was like over 100 days now...running debian 2.2r5 w/2.4.18 kernel...a mini-beast...runs fine... AND, if you act now, i'll include at least 10 xtra 20' CAT-5 cables to wire your dorm/apartment AND my linksys 4-port hub for FREE!!! (crowd ooh's and aah's) as is...must go...play with it first if you like...make an offer if you're interested! THANKS! -jeff MWBLUG (508)792-6070

April 16, 2002

bug report

by Bill Mills-Curran

I need some advice on where to send a bug report. Here's what happened: I was accessing an SMB filesystem mounted "mount -t smbfs" when file accesses (things like "ls" and "cd") started producing "Segmentation fault" messages. I looked in my system log and found: Apr 16 16:58:53 pent584 kernel: kernel BUG at dcache.c:128! Apr 16 16:58:53 pent584 kernel: invalid operand: 0000 Apr 16 16:58:53 pent584 kernel: CPU: 0 Apr 16 16:58:53 pent584 kernel: EIP: 0010:[dput+43/384] Apr 16 16:58:53 pent584 kernel: EIP: 0010:[<c014592b>] Apr 16 16:58:53 pent584 kernel: EFLAGS: 00010282 Apr 16 16:58:53 pent584 kernel: eax: 0000001c ebx: c0628c40 ecx: ffffffff edx: 00000000 Apr 16 16:58:53 pent584 kernel: esi: c6dd18c0 edi: c2497bc0 ebp: c0628c40 esp: c5c89f54 Apr 16 16:58:53 pent584 kernel: ds: 0018 es: 0018 ss: 0018 Apr 16 16:58:53 pent584 kernel: Process tcsh (pid: 5018, stackpage=c5c89000) Apr 16 16:58:53 pent584 kernel: Stack: c02128db c021297b 00000080 c3404c60 00000000 00000200 c3404c60 c3404c60 Apr 16 16:58:53 pent584 kernel: c6dd18c0 c0134531 c0628c40 c3404c60 00000000 00000000 bffe8148 c0133603 Apr 16 16:58:53 pent584 kernel: c3404c60 c625fc20 00000000 c3404c60 00000000 c3404c60 08119408 c0133653 Apr 16 16:58:53 pent584 kernel: Call Trace: [error_table+42755/46744] [error_table+42915/46744] [fput+113/208] [filp_close+83/96] [sys_close+67/80] [system_call+51/56] Apr 16 16:58:53 pent584 kernel: Call Trace: [<c02128db>] [<c021297b>] [<c0134531>] [<c0133603>] [<c0133653>] [<c010901b>] Apr 16 16:58:53 pent584 kernel: Apr 16 16:58:53 pent584 kernel: Code: 0f 0b 83 c4 0c ff 0b 0f 94 c0 84 c0 0f 84 33 01 00 00 8d 43 I tried to dismount the suspect filesystem, but I couldn't -- filesystem busy, even though there were no live processes on it. Then, operations on other filesystems started failing, finally ending up with a frozen system. I power cycled, and everything is happy again. So, here's what I found in the MAINTAINERS file: SMB FILESYSTEM P: Urban Widmark M: urban(a)teststation.com W: http://samba.org/ L: samba(a)samba.org S: Maintained DEVICE FILESYSTEM P: Richard Gooch M: rgooch(a)atnf.csiro.au L: linux-kernel(a)vger.kernel.org S: Maintained BTW, I'm running RedHat 7.1. So, who do I tell? TIA, Bill Mills-Curran

April 16, 2002