lkml.org 
[lkml]   [2003]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: Everything gone!
    From
    Date
    >>>>> "Richard" == Richard B Johnson <root@chaos.analogic.com> writes:

    Richard> How did [they] do this?

    If you look at the Received headers in the faked message, it actually
    came to kernel.org from alog0102.analogic.com, from Analogic's
    208.224.220.0/22 netblock, not from quark.analogic.com (in Analogic's
    204.178.40.0/21 block) as it claimed:

    Received: from alog0102.analogic.com ([208.224.220.117]:12804 "EHLO
    quark.analogic.com") by vger.kernel.org with ESMTP
    id <S263082AbTCSPfa>; Wed, 19 Mar 2003 10:35:30 -0500

    If an analogic box was cracked, look at 208.224.220.117, not at quark.

    The routing suggests they would not have been able to spoof the IP,
    unless they did so over eg an 802.11 link at whatever site
    208.224.220.0/22 is used.

    -JimC

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:34    [W:0.040 / U:0.196 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site