|
HMMM okay well this all in one linux box is going
to go away pretty soon. I am configuring one I can manage and get to root it
will have spam assassin etc. Just takes time but lately I have not had any with
all the crap that has gone down this week..
Interesting seeing all the traffic with this tool.
Its awesome!
----- Original Message -----
Sent: Thursday, September 11, 2003 11:22
AM
Subject: Re: [smartBridges] HELP net
traffic and where is it coming from
POP3 uses plaintext authentication. You need to
use Secure POP3 service if you wish client <-> server confidentiality
during mail exchange.
----- Original Message -----
Sent: Thursday, September 11, 2003 7:07
PM
Subject: Re: [smartBridges] HELP net
traffic and where is it coming from
Interesting looking at the logs I see my
computer go out and request mail from a pop 3 account and it SHOWS my
password? is it supposed to do that??? This tool could be dangerous in the
wrong hands..
----- Original Message -----
Sent: Thursday, September 11, 2003
10:56 AM
Subject: Re: [smartBridges] HELP net
traffic and where is it coming from
I also notice now that I am scanning again
that 48% of my traffic is ARP traffic coming from my router does that not
seem a little high??
Why would it need to ARP so many times isn't
there an ARP cache in the router to allow it to not request so many times?
Right now just in a 2 min scan there was over 2100 requests?
Thanks
----- Original Message -----
Sent: Thursday, September 11, 2003
10:43 AM
Subject: RE: [smartBridges] HELP
net traffic and where is it coming from
That will obviously be much better. However, I still would
hesitate to allow my provider complete control over my router. I
have quite a few "Tweaked" routers, we run wccp, cef and a few other
things that I need to know are running correctly. Just my .02, Not
being a smart ass or anything.
Scott
Well that is true if I had a Cisco router
I would be able to do that but megapath gave me this cheesy Siemens
router and they did not install any kind of firewall software
installed so I cant make any rules in it or I would have done this
long ago. The attack stopped so I am not to worried anymore.. but you
are right with the new managed router from AT&T I will request
certain IP schemes to be blocked..
----- Original Message -----
Sent: Thursday, September 11,
2003 10:15 AM
Subject: RE: [smartBridges]
HELP net traffic and where is it coming from
It is not really your providers problem. If you are an
ISP, you need to know how to manage your router. That is not
meant to be a slam or anything, but if you have traffic coming into
your network, you need to know where it is from and how to manage
it.
Scott
I don't have ping.exe in there?? I
also tried ICMP I am calling my provider to block both their class
C blocks from ever getting to me. My partner went to go pay them a
visit OHH man I feel sorry for them HE IS PISSED!
----- Original Message -----
Sent: Thursday, September
11, 2003 9:25 AM
Subject: Re: [smartBridges]
HELP net traffic and where is it coming from
On your Win2K box, go to 'Services'
and look for ping.exe.
----- Original Message -----
Sent: Thursday, September
11, 2003 9:42 AM
Subject: Re:
[smartBridges] HELP net traffic and where is it coming
from
Well it does not appear to be the
mail linux box as much as it is the dns server win 2000 what's
strange is I can physically unplug the cable from the box and
the outgoing traffic stops yet the incoming is still going???
I unplug the wan and it goes away..
----- Original Message -----
Sent: Thursday,
September 11, 2003 8:30 AM
Subject: RE:
[smartBridges] HELP net traffic and where is it coming
from
If you are running an old linux box
that you don't have a root password for, that means it is
more than likely out of date as far as patches go.
That means it could possibly be "Rooted" and that is not a
good thing!!! There are alot of DNS DDOS attachs out
there, I would download ethereal and watch the traffic VERY
closely for a couple of hours.
Scott
I have Brilan bandwidth
control and for kicks I put my servers behind it and just
yesterday I noticed that I have a steady 250kbps up and
down on my DNS and my mail server I unplug the Lan
connection to my T-1 and the problem goes away so I know
it is not my wireless customers? I did a sweep and found
nor worms on my 2000 machine I do have Linux 6.4 machine
that I don't know root so cant run any kind of scan but it
appears that it is coming from the WWW? how can I tell
what IP or where this is coming from its almost like a
DNS??? things are functioning normal but a little slow
since this is taking some of the bandwidth?? can or would
my ISP (megapath) be able to tell where it is coming
from???
I have a strange feeling the
WAR has started between me and the competition since they
threatened to do something for their 3 customers jumping
ship and coming to me because of their poor
service!
I have TCP IP Dump but cant
really see any thing specific to those IP
addresses??
|
