Jeff Newmiller wrote: > > On Fri, 8 Mar 2002, Michael D. Schleif wrote: > > > We are seeing martians on internal networks on a regular basis. > > > > Usually, it is traceable to users logging into AOL over our high speed > > internet connections: > > > > 172.128.0.0 - 172.191.255.255 > > > > Today, we saw one from United Airlines: > > > > 205.174.16.0 - 205.174.23.255 > > > > [1] How does this happen? > > I often wonder how it happens that people who should know better fail to > provide specific error and log messages and explain what they know about > the particulars of the ip addresses, routes, machines and connections > involved. It is hard to trust reports as sanitized as this.
Jeff, I respect your intelligence and firewall skills; however, if you read exactly what I posted, then you will know exactly what there is to know. > On the surface, the idea that packets should be generated within your LAN > with source addresses outside your network would suggest something is > seriously broken (accidentally or purposefully) with the workstation > generating the packets. That is one idea, isn't it? > > [2] Why does this happen? > > Speculation: if your AOL users are actually dialling into AOL while being > on the network, they may be temporarily acquiring an IP from AOL, and > Windows could possibly screw up and ships packets out the wrong interface. > However, something would have to be pretty weird with the AOL software if > it decided it had an AOL IP even if no dialup had occurred. There could > possibly be overlap when a dialup connection was lost as well. Please, please, please, read my post and respond accordingly: `` ... users logging into AOL over our high speed internet connections ... '' They are *NOT* _dialing_ into AOL !!! Or, even if they were, the questions remain the same -- what's the difference? > > [3] Is this exploitable? > > Insufficient data. How much data will suffice? A smattering of log entries: Feb 26 08:17:36 redtrout kernel: martian source 0b49a2ac for ffffffff, dev eth1 Feb 26 08:21:11 redtrout kernel: martian source 490b99ac for ffffffff, dev eth1 Feb 26 08:21:13 redtrout kernel: martian source 490b99ac for ffffffff, dev eth1 Feb 26 08:21:45 redtrout kernel: martian source 995c9eac for ffffffff, dev eth1 Feb 26 08:21:47 redtrout kernel: martian source 995c9eac for ffffffff, dev eth1 Feb 26 08:22:45 redtrout kernel: martian source 995c9eac for ffffffff, dev eth1 Feb 26 08:22:46 redtrout kernel: martian source 995c9eac for ffffffff, dev eth1 Feb 26 08:22:55 redtrout kernel: martian source 995c9eac for ffffffff, dev eth1 Feb 26 08:22:57 redtrout kernel: martian source 995c9eac for ffffffff, dev eth1 Feb 26 08:23:11 redtrout kernel: martian source c75c9eac for ffffffff, dev eth1 Feb 26 08:23:13 redtrout kernel: martian source c75c9eac for ffffffff, dev eth1 Feb 26 08:25:02 redtrout kernel: martian source b16f98ac for ffffffff, dev eth1 Feb 26 08:25:04 redtrout kernel: martian source b16f98ac for ffffffff, dev eth1 Feb 26 10:03:09 redtrout kernel: martian source a0fb99ac for ffffffff, dev eth1 Feb 26 10:03:11 redtrout kernel: martian source a0fb99ac for ffffffff, dev eth1 Feb 26 11:28:11 redtrout kernel: martian source 3c779bac for ffffffff, dev eth1 Feb 26 11:28:13 redtrout kernel: martian source 3c779bac for ffffffff, dev eth1 Feb 26 11:28:39 redtrout kernel: martian source ebb195ac for ffffffff, dev eth1 Feb 26 11:28:41 redtrout kernel: martian source ebb195ac for ffffffff, dev eth1 Feb 26 11:29:26 redtrout kernel: martian source 4d779bac for ffffffff, dev eth1 Feb 26 11:29:28 redtrout kernel: martian source 4d779bac for ffffffff, dev eth1 Feb 27 07:40:30 redtrout kernel: martian source 3336baac for ffffffff, dev eth1 Feb 27 07:40:32 redtrout kernel: martian source 3336baac for ffffffff, dev eth1 Feb 27 07:42:40 redtrout kernel: martian source 5236baac for ffffffff, dev eth1 Feb 27 07:42:42 redtrout kernel: martian source 5236baac for ffffffff, dev eth1 Feb 27 07:43:17 redtrout kernel: martian source c16e82ac for ffffffff, dev eth1 Feb 27 07:43:19 redtrout kernel: martian source c16e82ac for ffffffff, dev eth1 Feb 27 08:25:08 redtrout kernel: martian source 765a8fac for ffffffff, dev eth1 Feb 27 08:25:10 redtrout kernel: martian source 765a8fac for ffffffff, dev eth1 Feb 27 08:49:04 redtrout kernel: martian source 05f6a3ac for ffffffff, dev eth1 Feb 27 08:49:06 redtrout kernel: martian source 05f6a3ac for ffffffff, dev eth1 Feb 27 08:49:27 redtrout kernel: martian source 5be7acac for ffffffff, dev eth1 Feb 27 08:49:29 redtrout kernel: martian source 5be7acac for ffffffff, dev eth1 Feb 27 08:51:01 redtrout kernel: martian source fa35a0ac for ffffffff, dev eth1 Feb 27 08:51:03 redtrout kernel: martian source fa35a0ac for ffffffff, dev eth1 Feb 27 13:10:16 redtrout kernel: martian source c46299ac for ffffffff, dev eth1 Feb 27 13:10:18 redtrout kernel: martian source c46299ac for ffffffff, dev eth1 Feb 27 14:56:05 redtrout kernel: martian source d0ab9cac for ffffffff, dev eth1 Feb 27 14:56:07 redtrout kernel: martian source d0ab9cac for ffffffff, dev eth1 Feb 27 14:56:25 redtrout kernel: martian source 25ab9cac for ffffffff, dev eth1 Feb 27 14:56:27 redtrout kernel: martian source 25ab9cac for ffffffff, dev eth1 Feb 28 07:40:40 redtrout kernel: martian source 390184ac for ffffffff, dev eth1 Feb 28 07:40:42 redtrout kernel: martian source 390184ac for ffffffff, dev eth1 Feb 28 07:42:05 redtrout kernel: martian source 25fb8aac for ffffffff, dev eth1 Feb 28 07:42:07 redtrout kernel: martian source 25fb8aac for ffffffff, dev eth1 Feb 28 07:53:16 redtrout kernel: martian source 25fb8aac for 1549f80c, dev eth1 Feb 28 07:53:19 redtrout kernel: martian source 25fb8aac for 1549f80c, dev eth1 Feb 28 08:28:32 redtrout kernel: martian source b18c85ac for ffffffff, dev eth1 Feb 28 08:28:34 redtrout kernel: martian source b18c85ac for ffffffff, dev eth1 Feb 28 08:31:45 redtrout kernel: martian source b18c85ac for de59f340, dev eth1 Feb 28 08:37:35 redtrout kernel: martian source b18c85ac for 53f858d1, dev eth1 Feb 28 08:37:38 redtrout kernel: martian source b18c85ac for 53f858d1, dev eth1 Feb 28 08:40:05 redtrout kernel: martian source b18c85ac for ffffffff, dev eth1 Feb 28 08:40:07 redtrout kernel: martian source b18c85ac for ffffffff, dev eth1 Feb 28 11:56:28 redtrout kernel: martian destination efea0000 from 4901a8c0, dev eth1 Mar 1 07:46:03 redtrout kernel: martian source e4f98bac for ffffffff, dev eth1 Mar 1 07:46:05 redtrout kernel: martian source e4f98bac for ffffffff, dev eth1 Mar 1 07:53:16 redtrout kernel: martian source b5be80ac for ffffffff, dev eth1 Mar 1 07:53:18 redtrout kernel: martian source b5be80ac for ffffffff, dev eth1 Mar 1 08:10:03 redtrout kernel: martian source cff18eac for ffffffff, dev eth1 Mar 1 08:10:05 redtrout kernel: martian source cff18eac for ffffffff, dev eth1 Mar 1 13:12:04 redtrout kernel: martian source a94290ac for ffffffff, dev eth1 Mar 1 13:12:06 redtrout kernel: martian source a94290ac for ffffffff, dev eth1 Mar 1 13:13:36 redtrout kernel: martian source 76b595ac for ffffffff, dev eth1 Mar 1 13:13:38 redtrout kernel: martian source 76b595ac for ffffffff, dev eth1 Mar 1 13:14:27 redtrout kernel: martian source f5b595ac for ffffffff, dev eth1 Mar 1 13:14:29 redtrout kernel: martian source f5b595ac for ffffffff, dev eth1 Mar 1 15:23:20 redtrout kernel: martian source 8e6490ac for ffffffff, dev eth1 Mar 1 15:23:22 redtrout kernel: martian source 8e6490ac for ffffffff, dev eth1 Mar 1 16:21:38 redtrout kernel: martian source 6ba99eac for ffffffff, dev eth1 Mar 1 16:21:40 redtrout kernel: martian source 6ba99eac for ffffffff, dev eth1 Mar 1 16:22:04 redtrout kernel: martian source 646490ac for ffffffff, dev eth1 Mar 1 16:22:06 redtrout kernel: martian source 646490ac for ffffffff, dev eth1 Mar 4 08:07:18 redtrout kernel: martian source df1aa0ac for ffffffff, dev eth1 Mar 4 08:07:20 redtrout kernel: martian source df1aa0ac for ffffffff, dev eth1 Mar 4 08:11:51 redtrout kernel: martian source b41aa0ac for ffffffff, dev eth1 Mar 4 08:11:53 redtrout kernel: martian source b41aa0ac for ffffffff, dev eth1 Mar 5 08:45:52 redtrout kernel: martian source 670b87ac for ffffffff, dev eth1 Mar 5 08:45:54 redtrout kernel: martian source 670b87ac for ffffffff, dev eth1 Mar 5 08:46:13 redtrout kernel: martian source f60b87ac for ffffffff, dev eth1 Mar 5 08:46:15 redtrout kernel: martian source f60b87ac for ffffffff, dev eth1 Mar 5 08:46:55 redtrout kernel: martian source b361afac for ffffffff, dev eth1 Mar 5 08:46:57 redtrout kernel: martian source b361afac for ffffffff, dev eth1 Mar 5 10:05:21 redtrout kernel: martian source ed449fac for ffffffff, dev eth1 Mar 5 10:05:24 redtrout kernel: martian source ed449fac for ffffffff, dev eth1 Mar 5 13:20:47 redtrout kernel: martian source 2bc09dac for ffffffff, dev eth1 Mar 5 13:20:49 redtrout kernel: martian source 2bc09dac for ffffffff, dev eth1 Mar 5 13:35:10 redtrout kernel: martian source 1ee39eac for ffffffff, dev eth1 Mar 5 13:35:12 redtrout kernel: martian source 1ee39eac for ffffffff, dev eth1 Mar 5 14:46:37 redtrout kernel: martian source 224d92ac for ffffffff, dev eth1 Mar 5 14:46:39 redtrout kernel: martian source 224d92ac for ffffffff, dev eth1 Mar 5 14:47:45 redtrout kernel: martian source 224d92ac for ffffffff, dev eth1 Mar 5 14:47:47 redtrout kernel: martian source 224d92ac for ffffffff, dev eth1 Mar 5 14:48:06 redtrout kernel: martian source 92229cac for ffffffff, dev eth1 Mar 5 14:48:08 redtrout kernel: martian source 92229cac for ffffffff, dev eth1 Mar 6 07:33:29 redtrout kernel: martian source 4dfca5ac for ffffffff, dev eth1 Mar 6 07:33:31 redtrout kernel: martian source 4dfca5ac for ffffffff, dev eth1 Mar 6 07:37:13 redtrout kernel: martian source 4dfca5ac for ffffffff, dev eth1 Mar 6 07:37:15 redtrout kernel: martian source 4dfca5ac for ffffffff, dev eth1 Mar 6 08:09:39 redtrout kernel: martian source cf33abac for ffffffff, dev eth1 Mar 6 08:09:41 redtrout kernel: martian source cf33abac for ffffffff, dev eth1 Mar 6 11:51:40 redtrout kernel: martian source 879c88ac for ffffffff, dev eth1 Mar 6 11:51:42 redtrout kernel: martian source 879c88ac for ffffffff, dev eth1 Mar 6 11:52:21 redtrout kernel: martian source 879c88ac for ffffffff, dev eth1 Mar 6 11:52:23 redtrout kernel: martian source 879c88ac for ffffffff, dev eth1 Mar 6 11:54:28 redtrout kernel: martian source 9bdf8bac for ffffffff, dev eth1 Mar 6 11:54:30 redtrout kernel: martian source 9bdf8bac for ffffffff, dev eth1 Mar 6 13:17:17 redtrout kernel: martian source f9f88aac for ffffffff, dev eth1 Mar 6 13:17:19 redtrout kernel: martian source f9f88aac for ffffffff, dev eth1 Mar 6 13:17:55 redtrout kernel: martian source c2548fac for ffffffff, dev eth1 Mar 6 13:17:57 redtrout kernel: martian source c2548fac for ffffffff, dev eth1 Mar 6 13:18:12 redtrout kernel: martian source 5d548fac for ffffffff, dev eth1 Mar 6 13:18:14 redtrout kernel: martian source 5d548fac for ffffffff, dev eth1 Mar 6 16:15:34 redtrout kernel: martian source de849fac for ffffffff, dev eth1 Mar 6 16:15:36 redtrout kernel: martian source de849fac for ffffffff, dev eth1 Mar 6 16:16:14 redtrout kernel: martian source de849fac for 7a01cfc8, dev eth1 Mar 6 17:23:26 redtrout kernel: martian source 83129dac for ffffffff, dev eth1 Mar 6 17:23:28 redtrout kernel: martian source 83129dac for ffffffff, dev eth1 Mar 7 07:41:20 redtrout kernel: martian source d843a3ac for ffffffff, dev eth1 Mar 7 07:41:22 redtrout kernel: martian source d843a3ac for ffffffff, dev eth1 Mar 7 07:41:52 redtrout kernel: martian source 618ea7ac for ffffffff, dev eth1 Mar 7 07:41:54 redtrout kernel: martian source 618ea7ac for ffffffff, dev eth1 Mar 7 08:32:42 redtrout kernel: martian source e4f79cac for ffffffff, dev eth1 Mar 7 08:32:44 redtrout kernel: martian source e4f79cac for ffffffff, dev eth1 Mar 7 09:07:10 redtrout kernel: martian source 187994ac for ffffffff, dev eth1 Mar 7 09:07:12 redtrout kernel: martian source 187994ac for ffffffff, dev eth1 Mar 7 10:07:36 redtrout kernel: martian source a42e81ac for ffffffff, dev eth1 Mar 7 10:07:38 redtrout kernel: martian source a42e81ac for ffffffff, dev eth1 Mar 7 10:12:06 redtrout kernel: martian source 1de19fac for ffffffff, dev eth1 Mar 7 10:12:08 redtrout kernel: martian source 1de19fac for ffffffff, dev eth1 Mar 7 10:54:24 redtrout kernel: martian source 7d1ca0ac for ffffffff, dev eth1 Mar 7 10:54:26 redtrout kernel: martian source 7d1ca0ac for ffffffff, dev eth1 Mar 7 10:54:32 redtrout kernel: martian source 7d1ca0ac for 372b9ed3, dev eth1 Mar 7 10:54:35 redtrout kernel: martian source 7d1ca0ac for 372b9ed3, dev eth1 Mar 7 11:31:39 redtrout kernel: martian source cab38aac for ffffffff, dev eth1 Mar 7 11:31:41 redtrout kernel: martian source cab38aac for ffffffff, dev eth1 Mar 7 11:31:54 redtrout kernel: martian source 022285ac for ffffffff, dev eth1 Mar 7 11:31:56 redtrout kernel: martian source 022285ac for ffffffff, dev eth1 Mar 7 13:42:06 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:42:08 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:43:11 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:43:13 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:44:51 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:46:02 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:46:04 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:46:38 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:46:40 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:47:14 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:47:16 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 13:47:42 redtrout kernel: martian source 4f8e85ac for ffffffff, dev eth1 Mar 7 15:03:27 redtrout kernel: martian source f19c88ac for ffffffff, dev eth1 Mar 7 15:03:29 redtrout kernel: martian source f19c88ac for ffffffff, dev eth1 Mar 7 16:51:33 redtrout kernel: martian source 04baa1ac for ffffffff, dev eth1 Mar 7 16:51:35 redtrout kernel: martian source 04baa1ac for ffffffff, dev eth1 Mar 7 17:29:10 redtrout kernel: martian source 04baa1ac for 07f642cb, dev eth1 Mar 7 17:29:13 redtrout kernel: martian source 04baa1ac for 07f642cb, dev eth1 Mar 8 09:28:14 pinktrout kernel: martian source 3210aecd for 650da8c0, dev eth0 Mar 8 09:28:14 pinktrout kernel: martian source 3210aecd for 650da8c0, dev eth0 Mar 8 09:28:14 pinktrout kernel: martian source 3210aecd for 650da8c0, dev eth0 Mar 8 09:28:14 pinktrout kernel: martian source 3210aecd for 650da8c0, dev eth0 Mar 8 09:28:16 pinktrout kernel: martian source 3210aecd for 650da8c0, dev eth0 Mar 8 09:28:19 pinktrout kernel: martian source 3210aecd for 650da8c0, dev eth0 Mar 8 13:03:32 redtrout kernel: martian source 684789ac for ffffffff, dev eth1 Mar 8 13:03:34 redtrout kernel: martian source 684789ac for ffffffff, dev eth1 Mar 8 13:14:08 redtrout kernel: martian source 684789ac for 976e9318, dev eth1 Mar 8 13:14:11 redtrout kernel: martian source 684789ac for 976e9318, dev eth1 Mar 8 13:14:16 redtrout kernel: martian source 684789ac for 976e9318, dev eth1 Mar 8 13:17:49 redtrout kernel: martian source 684789ac for 5ea7fe50, dev eth1 Mar 8 13:17:52 redtrout kernel: martian source 684789ac for 5ea7fe50, dev eth1 Mar 8 13:17:58 redtrout kernel: martian source 684789ac for 5ea7fe50, dev eth1 Mar 8 13:58:56 redtrout kernel: martian source 684789ac for 0f3e4142, dev eth1 Mar 8 13:58:59 redtrout kernel: martian source 684789ac for 0f3e4142, dev eth1 Mar 8 13:59:05 redtrout kernel: martian source 684789ac for 0f3e4142, dev eth1 Mar 8 13:59:17 redtrout kernel: martian source 684789ac for 0f3e4142, dev eth1 Mar 8 14:25:35 redtrout kernel: martian source 684789ac for 5ec81cc8, dev eth1 Mar 8 14:25:38 redtrout kernel: martian source 684789ac for 5ec81cc8, dev eth1 Mar 8 14:25:44 redtrout kernel: martian source 684789ac for 5ec81cc8, dev eth1 Mar 8 16:02:08 redtrout kernel: martian source 684789ac for 5daf6397, dev eth1 Mar 8 16:02:11 redtrout kernel: martian source 684789ac for 5daf6397, dev eth1 Mar 8 16:35:32 redtrout kernel: martian source 684789ac for 7b490b3d, dev eth1 Mar 8 16:35:34 redtrout kernel: martian source 684789ac for 7b490b3d, dev eth1 Mar 8 16:35:38 redtrout kernel: martian source 684789ac for 7b490b3d, dev eth1 For those who cannot be bothered to find their hex calculators: 0.0.234.239 efea0000 12.248.73.21 1549f80c 24.147.110.151 976e9318 61.11.73.123 7b490b3d 64.243.89.222 de59f340 66.65.62.15 0f3e4142 80.254.167.94 5ea7fe50 151.99.175.93 5daf6397 172.128.190.181 b5be80ac 172.129.46.164 a42e81ac 172.130.110.193 c16e82ac 172.132.1.57 390184ac 172.133.140.177 b18c85ac 172.133.142.79 4f8e85ac 172.133.34.2 022285ac 172.135.11.103 670b87ac 172.135.11.246 f60b87ac 172.136.156.135 879c88ac 172.136.156.241 f19c88ac 172.137.71.104 684789ac 172.138.179.202 cab38aac 172.138.248.249 f9f88aac 172.138.251.37 25fb8aac 172.139.223.155 9bdf8bac 172.139.249.228 e4f98bac 172.142.241.207 cff18eac 172.143.84.194 c2548fac 172.143.84.93 5d548fac 172.143.90.118 765a8fac 172.144.100.100 646490ac 172.144.100.142 8e6490ac 172.144.66.169 a94290ac 172.146.77.34 224d92ac 172.148.121.24 187994ac 172.149.177.235 ebb195ac 172.149.181.118 76b595ac 172.149.181.245 f5b595ac 172.152.111.177 b16f98ac 172.153.11.73 490b99ac 172.153.251.160 a0fb99ac 172.153.98.196 c46299ac 172.155.119.60 3c779bac 172.155.119.77 4d779bac 172.156.171.208 d0ab9cac 172.156.171.37 25ab9cac 172.156.247.228 e4f79cac 172.156.34.146 92229cac 172.157.18.131 83129dac 172.157.192.43 2bc09dac 172.158.169.107 6ba99eac 172.158.227.30 1ee39eac 172.158.92.153 995c9eac 172.158.92.199 c75c9eac 172.159.132.222 de849fac 172.159.225.29 1de19fac 172.159.68.237 ed449fac 172.160.26.180 b41aa0ac 172.160.26.223 df1aa0ac 172.160.28.125 7d1ca0ac 172.160.53.250 fa35a0ac 172.161.186.4 04baa1ac 172.162.73.11 0b49a2ac 172.163.246.5 05f6a3ac 172.163.67.216 d843a3ac 172.165.252.77 4dfca5ac 172.167.142.97 618ea7ac 172.171.51.207 cf33abac 172.172.231.91 5be7acac 172.175.97.179 b361afac 172.186.54.51 3336baac 172.186.54.82 5236baac 192.168.1.73 4901a8c0 192.168.13.101 650da8c0 200.28.200.94 5ec81cc8 200.207.1.122 7a01cfc8 203.66.246.7 07f642cb 205.174.16.50 3210aecd 209.88.248.83 53f858d1 211.158.43.55 372b9ed3 255.255.255.255 ffffffff What more do you need? -- Best Regards, mds mds resource 888.250.3987 Dare to fix things before they break . . . Our capacity for understanding is inversely proportional to how much we think we know. The more I know, the more I know I don't know . . . _______________________________________________ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
