Oleg Goryunov wrote:
A good explanation I received from a datacenter where I have the server:
"we classify this sort of issue as "Stealing the gateway". basically
what someone does is they send out false arp packets(flooding the entire
network segment) causing all servers and switching to think their server
is the
gateway instead of our router. they can then insert their own frame
inside of
all web traffic. this sort of issue is usually resolved within a few minutes
when we terminate the server. most likely this is what happened and explains
why the issue started and then suddenly went away without any evidence
on your
server of being hacked."
Unfortunately, they said they did not have a database of registered
events of this kind. :(
The problem is detecting the problem TO log it. Often it's outside the actual
data centre. Firebird had it's website being redirected, but only on a couple of
DNS servers, everybody else saw the correct IP address. Your description of 'all
sites' simply confirms that your users are getting the wrong DNS lookup, rather
than YOUR site having been compromised.
--
Lester Caine - G8HFL
-----------------------------
Contact - http://lsces.co.uk/wiki/?page=contact
L.S.Caine Electronic Services - http://lsces.co.uk
EnquirySolve - http://enquirysolve.com/
Model Engineers Digital Workshop - http://medw.co.uk//
Firebird - http://www.firebirdsql.org/index.php
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
" from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org
