Re: Unknown process modifying routing table

2021-02-07 Thread Jan Stary
On Feb 06 12:18:40, ja...@jmp-e.com wrote: > I've disabled my VPN on the machine as well as dhclient, connecting via a > fixed static IP address and DNS servers. That would be a much aeasier environment to debug this. So please show your hostname.if, mygate and your routing table right after

Re: Unknown process modifying routing table

2021-02-06 Thread Claudio Jeker
On Sat, Feb 06, 2021 at 02:16:20PM +0100, Otto Moerbeek wrote: > On Sat, Feb 06, 2021 at 12:18:40PM +, James wrote: > > > I've disabled my VPN on the machine as well as dhclient, connecting via a > > fixed static IP address and DNS servers. My routing table is still being > > modifed by PID 0

Re: Unknown process modifying routing table

2021-02-06 Thread James
I've disabled my VPN on the machine as well as dhclient, connecting via a fixed static IP address and DNS servers. My routing table is still being modifed by PID 0 (which I assume to be the kernel) every 30 minutes or so. Ntpd is also disabled. I have also caught my machine communicating to

Re: Unknown process modifying routing table

2021-02-06 Thread Otto Moerbeek
On Sat, Feb 06, 2021 at 12:18:40PM +, James wrote: > I've disabled my VPN on the machine as well as dhclient, connecting via a > fixed static IP address and DNS servers. My routing table is still being > modifed by PID 0 (which I assume to be the kernel) every 30 minutes or so. > Ntpd is also

Re: Unknown process modifying routing table

2021-02-06 Thread Jan Stary
On Jan 26 15:10:03, ja...@jmp-e.com wrote: > > Hi all, > > My routing table is being modified by an unknown process. > > I have system accounting enabled and I'm monitoring route changes > but the PID of the process reported by `route monitor` is always 0 > for these unknown

Unknown process modifying routing table

2021-02-02 Thread James
Hi all, My routing table is being modified by an unknown process. I have system accounting enabled and I'm monitoring route changes but the PID of the process reported by `route monitor` is always 0 for these unknown changes. I've seen my default route (VPN) being