[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Weird log message



* Karsten M. Self (kmself@ix.netcom.com) spake thusly:
> on Thu, Dec 27, 2001 at 11:35:37PM -0600, shock (stephen@virtual-attorney.com) wrote:
> > I keep getting the following in my log file:
> > 
> > Dec 27 23:17:00 exitwound sshd2[3771]: X11 connection from
> > 192.168.9.1:3367 (server01.exitwound.org)
> > 
> > Does anyone have some idea as to what this is?  It started showing up
> > about 3 days ago.
> 
> If that's not a system on your local network, then it appears that
> someone's spoofing local IPs to try connecting to your system.
> 196.168.*.* should be nonrouteable.  A firewall will block these
> connections.

192.168.9.1 is a local system, and it's the system from which the log
messages are originating.  it's very odd, because it happens fairly
often, it's quite random.  i haven't been able to track it down.....
-- 
 ____) ,_)        ,_)
(-(__  |_  _  _ |/
 ____) | |(_)(_ |\
(                 \_,
 _______________________________________________
| http://www.exitwound.org : hard to find       |
 _______________________________________________
| Alex Haley was adopted!                       |
 _______________________________________________
 -------------BEGIN GEEK CODE BLOCK-------------
| Version: 3.1                                  |
| GJ/IT d- s: a C+++>$ UL++++ P+++ L+++ E--- W++| 
| N+@ o K- w O- M- V PS+ PE Y+ PGP++ t+@ 5@ X++ |
| R tv+@ b+ DI++++ D+ G++ e++++ h---- r+++ y+++ |
 --------------END GEEK CODE BLOCK--------------



Reply to: