On Thu, 11 Sep 2003, Mike Eheler wrote:

> Buchan Milne wrote:
> > But we don't know the subnet the original poster is using.
> 
> I guess that would be me. I'm not 100% familiar on network stuff so I'll 
> just describe my layout.

No problem ...

> 
> I have 3 computers on the lan, all with static IP addresses in the range 
> of 192.168.1.2-192.168.1.255 (192.168.1.1 is reserved for the router).

OK, I will assume that your router is then doing network address 
translation, you use a subnet mask of 255.255.255.0, which means that no 
icmp (ping) traffic should be generated by lisa to any machine outside 
your network. Thus, the only traffic that lisa could be causing is arp 
traffic for 255 nodes (which shouldn't fill the arp cache on any device 
designed specifically for this situation, and should not cause any weird 
behaviour), and portscans to machines which replied to the ping (which 
should also not cause a problem).

> 
> They all plug into a 6-port hub which uplinks to the router which then 
> plugs directly into my cable modem.
> 
> If you need any more information, let me know. I'll try disabling lisa 
> on my own machine to see if that makes any difference.

If it really is lisa causing this, then we would have to disable lisa, 
since there is no way to prevent this if it is indeed the problem. 
However, the blaster worm would cause almost identical (except much higher 
traffic) traffic, and I have't seen any reports of linksys routers being 
rebooted by blaster.

Regards,
Buchan

-- 
|----------------Registered Linux User #182071-----------------|
Buchan Milne                Mechanical Engineer, Network Manager
Cellphone * Work            +27 82 472 2231 * +27 21 8828820x121
Stellenbosch Automotive Engineering         http://www.cae.co.za
GPG Key                   http://ranger.dnsalias.com/bgmilne.asc
1024D/60D204A7 2919 E232 5610 A038 87B1 72D6 AC92 BA50 60D2 04A7
*****************************************************************
Please click on http://www.cae.co.za/disclaimer.htm to read our
e-mail disclaimer or send an e-mail to [EMAIL PROTECTED] for a copy.
*****************************************************************

Reply via email to