Re: Hacker de la red,
Si no recuerdo mal 4662 es uno de los puertos que usa el burro.
On Fri, 31 Jan 2003 19:35:34 +0100
Borxa Varela <borxa@wanadoo.es> wrote:
> La historia:
> Me doy de alta en la tarifa plana de wanadoo por RTB, me conecto sin
> problemas. Para despreocuparme de encender/apagar el modem, configuro el
> pppd con las opciones (entre otras)
> demand
> active-filter "dst port domain"
> idle 300
>
> Bueno, pues se conecta cuando alguien pide resolver un ip, pero no se
> desconecta si pasan 300 segundos sin que nadie pida resolver ips,
> entonces abro una consola y pongo tcpdump -i ppp0, y compruebo
> impresionado que no paran de pasar "paquetitos" de un lado para otro,
> principalmente en el puerto 4662 que no se para que es, y mi pregunta es
> ¿quien o que coño esta enviando esa cantidad de paquetes? y paso ¿porque
> no funciona la opción para el pppd?
>
> Para muestra un boton: (si tocar nada ni, chat, ni webs cargadas ni nada
> por el estilo), recien conectado (e recivido el correo y estoy
> escribiendo este mensaje)
>
> xuvenka:/home/borxa# tcpdump -i ppp0
> tcpdump: listening on ppp0
> 19:32:02.967746 80.32.26.66.1701 > 80.103.152.191.4662: S
> 2218963593:2218963593(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
> 19:32:02.967857 80.103.152.253.1701 > 80.103.152.191.4662: S
> 2218963593:2218963593(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
> 19:32:21.877739 217.128.24.251.4016 > 80.103.152.174.4662: S
> 1823402510:1823402510(0) win 16384 <mss 1452,nop,nop,sackOK> (DF)
> 19:32:21.877824 80.103.152.253.4016 > 80.103.152.174.4662: S
> 1823402510:1823402510(0) win 16384 <mss 1452,nop,nop,sackOK> (DF)
> 19:32:35.257749 80.25.196.158.58979 > 80.103.152.253.www: F
> 89294993:89294993(0) ack 1108620176 win 8760 (DF)
> 19:32:35.258449 80.103.152.253.www > 80.25.196.158.58979: P 1:307(306)
> ack 1 win 4452 (DF)
> 19:32:35.258636 80.103.152.253.www > 80.25.196.158.58979: F 307:307(0)
> ack 1 win 4452 (DF)
> 19:32:35.267744 80.25.196.158.59020 > 80.103.152.253.www: S
> 89339694:89339694(0) win 8192 <mss 1460,nop,nop,sackOK> (DF)
> 19:32:35.267833 80.103.152.253.www > 80.25.196.158.59020: S
> 1158816027:1158816027(0) ack 89339695 win 4452 <mss 1484,nop,nop,sackOK>
> (DF)
> 19:32:35.777749 80.25.196.158.58979 > 80.103.152.253.www: R
> 89294994:89294994(0) win 0 (DF)
> 19:32:35.787741 80.25.196.158.58979 > 80.103.152.253.www: R
> 89294994:89294994(0) win 0
> 19:32:35.807755 80.25.196.158.59020 > 80.103.152.253.www: . ack 1 win
> 8760 (DF)
> 19:32:35.827754 80.25.196.158.59020 > 80.103.152.253.www: P 1:67(66) ack
> 1 win 8760 (DF)
> 19:32:35.827941 80.103.152.253.www > 80.25.196.158.59020: . ack 67 win
> 4452 (DF)
> 19:32:42.087748 213.99.70.84.1650 > 80.103.152.154.1224: S
> 1437057425:1437057425(0) win 8760 <mss 536,nop,nop,sackOK> (DF)
> 19:32:42.087847 80.103.152.253.1650 > 80.103.152.154.1224: S
> 1437057425:1437057425(0) win 8760 <mss 536,nop,nop,sackOK> (DF)
> 19:32:51.017749 213.99.70.84.1650 > 80.103.152.154.1224: S
> 1437057425:1437057425(0) win 8760 <mss 536,nop,nop,sackOK> (DF)
> 19:32:51.017810 80.103.152.253.1650 > 80.103.152.154.1224: S
> 1437057425:1437057425(0) win 8760 <mss 536,nop,nop,sackOK> (DF)
> 19:33:20.047738 80.25.196.158.59020 > 80.103.152.253.www: F 67:67(0) ack
> 1 win 8760 (DF)
> 19:33:20.048371 80.103.152.253.www > 80.25.196.158.59020: P 1:307(306)
> ack 68 win 4452 (DF)
> 19:33:20.048557 80.103.152.253.www > 80.25.196.158.59020: F 307:307(0)
> ack 68 win 4452 (DF)
> 19:33:20.457748 80.25.196.158.59020 > 80.103.152.253.www: R
> 89339762:89339762(0) win 0 (DF)
> 19:33:20.467740 80.25.196.158.59020 > 80.103.152.253.www: R
> 89339762:89339762(0) win 0
> 19:33:23.287747 212.195.124.6.1617 > 80.103.152.154.1224: S
> 517915135:517915135(0) win 65535 <mss 1420,nop,nop,sackOK> (DF)
> 19:33:23.287849 80.103.152.253.1617 > 80.103.152.154.1224: S
> 517915135:517915135(0) win 65535 <mss 1420,nop,nop,sackOK> (DF)
> 19:33:24.767747 81.202.80.251.2686 > 80.103.152.253.www: S
> 3109526358:3109526358(0) win 64240 <mss 1460,nop,nop,sackOK> (DF)
> 19:33:24.767915 80.103.152.253.www > 81.202.80.251.2686: S
> 1219814282:1219814282(0) ack 3109526359 win 4452 <mss
> 1484,nop,nop,sackOK> (DF)
> 19:33:25.017742 81.202.80.251.2686 > 80.103.152.253.www: . ack 1 win
> 64240 (DF)
> 19:33:25.037748 81.202.80.251.2686 > 80.103.152.253.www: P 1:66(65) ack
> 1 win 64240 (DF)
> 19:33:25.037827 80.103.152.253.www > 81.202.80.251.2686: . ack 66 win
> 4452 (DF)
>
> 30 packets received by filter
> 0 packets dropped by kernel
> xuvenka:/home/borxa#
>
>
>
> --
> To UNSUBSCRIBE, email to debian-user-spanish-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
>
Reply to: