lkml.org 
[lkml]   [2000]   [Feb]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: How to survive in a Micro$oft environment??
Date
From
> 13:58:36.620000 207.109.151.249.9999 > 207.109.151.1.domain: 1341+ (46)
> (ttl 32, id 14354)
> 13:58:36.620000 207.109.151.249.9999 > jaguar.spectrumpub.com.domain:
> 1341+ (46) (ttl 32, id 14610)
> 13:58:36.620000 207.109.151.249.9999 > 207.109.151.3.domain: 1341+ (46)

That is an application. its issuing DNS queries aimed at the DNS port
of every machine on the class C.

My first guess is that the Lizard installer is trying to find the router
by spamming the entire class C at high speed.

> 13:58:36.640000 207.109.151.249.9999 > 207.109.151.255.domain: 1341+
> (46) (ttl 32, id 13843)

It even sends to the broadcast for the network (totally out of order)

> 13:58:36.640000 207.109.151.249.9999 > 207.109.151.0.domain: 1341+ (46)

And the network address.

> 13:58:36.640000 207.109.151.249.9999 > 207.109.151.1.domain: 1341+ (46)

One second later the app spams the network again

If I got that trace from a customer I'd probably demand a written promise that
they would not be running this software on their ISP connected network again
until fixed.

It could be glibc but I think its a broken app

Alan


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:56    [W:0.087 / U:0.952 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site