[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: ident being hammered...



* Randy Orrison (randy@orrison.com) [020502 14:08]:
> May  2 21:35:56 evo xinetd[1826]: START: ident pid=5161 from=<no address>
> May  2 21:35:56 evo xinetd[5161]: FAIL: ident address from=<no address>
> May  2 21:35:56 evo xinetd[1826]: START: ident pid=5162 from=<no address>
> May  2 21:35:56 evo xinetd[5162]: FAIL: ident address from=<no address>
> May  2 21:35:56 evo xinetd[1826]: Deactivating service ident due to
> 	excessive incoming connections.  Restarting in 10 seconds.
> May  2 21:35:56 evo xinetd[1826]: FAIL: ident connections per second from=<no address>
> 
> (I'm using pidentd.)  Any suggestions for this one?  At least with the
> netbios thing I could see that it was coming from the NT box, but for this
> one it isn't giving me the address it's coming from.

Do you run ipchains or iptables on the machine? You could set up a rule
to match incoming packets on your ident port and log them. That should
help - I don't know why you'd see "<no address>" there like that, but
the ip filtering should give you the address.

good times,
Vineet

-- 
Currently seeking opportunities in the SF Bay Area
Please see http://www.doorstop.net/resume.shtml

Attachment: pgpmNsRZa7gUB.pgp
Description: PGP signature


Reply to: