PROTECTED]]
Sent: Friday, January 18, 2002 8:45 PM
Cc: Craig Van Tassle; secuirty-basics
Subject: Re: loopback device
Also, try the following:
netstat -anp
The p option displays the program bound to that socket/port.
From the looks of your snort log, it did not *appear* to be a
loopback
address
,
Leon
- -Original Message-
From: shawn merdinger [mailto:[EMAIL PROTECTED]]
Sent: Friday, January 18, 2002 8:45 PM
Cc: Craig Van Tassle; secuirty-basics
Subject: Re: loopback device
Also, try the following:
netstat -anp
The p option displays
merdinger [mailto:[EMAIL PROTECTED]]
Sent: Friday, January 18, 2002 8:45 PM
Cc: Craig Van Tassle; secuirty-basics
Subject: Re: loopback device
Also, try the following:
netstat -anp
The p option displays the program bound to that socket/port.
From the looks of your snort log, it did
Also, try the following:
netstat -anp
The p option displays the program bound to that socket/port.
From the looks of your snort log, it did not *appear* to be a loopback
address.
-scm
On 15-Jan-2002 Craig Van Tassle wrote:
My loop back is supposed to be 127.0.0.1.. at least that is what
-basics
Subject: Re: loopback device
My loop back is supposed to be 127.0.0.1.. at least that is what my
ifconfig shows me.. and i have no idea what program is running on
that port.
Do you think that i could have a possible intrusin?
Thanks
Craig
On Tue, Jan 15, 2002 at 10:44:48AM
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Actually, most loopback devices respond to any IP within the 127/8 IP range,
because the entire /8 block is reserved for loopback purposes.
The fact that a program is using it isn't a ''bad'' thing, although it is
extremely odd.
I do have a few
I no the ip of my comp is totaly different that is why i was part of the reason i was
wondering about the loop back traffic. I do have and lsof and i will look in to that
to see what is going on..
And yesterday i saw a lot of traffic going in to and out of my DSL modem (physicaly
seperate
My loop back is supposed to be 127.0.0.1.. at least that is what my ifconfig shows
me.. and i have no idea what program is running on that port.
Do you think that i could have a possible intrusin?
Thanks
Craig
On Tue, Jan 15, 2002 at 10:44:48AM -0800, Glenn Pitcher wrote:
No, you can't
