Re: Hacked??

[Marc Haber <debian-firewall.lists.debian.org@marc-haber.de>]

On Fri, 22 Jun 2001 14:11:33 -0500, "Philippe Clérié"
<philippe@gcal.net> wrote:
>Jun 22 12:26:45 antares kernel: Packet log: output DENY eth1
>PROTO=17 myaddress:1024 10.0.8.40:53 L=65 S=0x00 I=30577 F=0x0000
>T=64 (#2)

Try to find out what name resolution was going on at that moment on
your system. Some brain-dead DNS administrators delegate publicly
visible zones to site local addresses. See the name server delegations
for de.abb.com for an example.

Greetings
Marc

-- 
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber          |   " Questions are the         | Mailadresse im Header
Karlsruhe, Germany  |     Beginning of Wisdom "     | Fon: *49 721 966 32 15
Nordisch by Nature  | Lt. Worf, TNG "Rightful Heir" | Fax: *49 721 966 31 29