Subject: secure?!?!?
From: root (ROOTnscape@netscape.net)
Date: Sat Dec 29 2001 - 06:56:41 AKST
ok .. i have been lookin thru my security logs for my router and i keep
seeing this line:
3|Dec 26 01 |From:192.168.0. To:224.0.1.24|attack |block
| 06:15:32 |UDP src port:00042 dest port:00042 |ip spoofing |
when i dns this ip address i see its: 224.0.1.24 is MICROSOFT-DS.MCAST.NET (224.0.1.24)
.. its a constant thing and im trying to figure out what is transmitting to mcast. i run ps -aux | grep mcast .. but i dont see a mcast thats there .. even when i do a netstat .. i dont see it. what is this .. its like almost hour on the hour .. every day .. and i dont know where in my box its originating, can someone help. p.s. i strive on how secure my boxen is... but this thing although its blocced is really annoying me since i cant figure out where it originates... after the wu-ftp thing and a couple of my friends being arrested for "computer" crimes recently ... i need to figure out what it is.... anywayz .. thanx in advance
p.s. im kinda buzzin from the E&J .. so excuse me if it gets confusing.. if you need more info.. you can email me here or at rootnscape@netscape.net
------My other computer is you win box-------
LiNuX or Fbsd?!? FeLoNiouS_MoNK
This archive was generated by hypermail 2a23 : Sun Dec 30 2001 - 11:13:12 AKST