Re: Console output?

["John Fleming" <john@wa9als.com>]

Hello

John Fleming (<john@wa9als.com>) wrote:

> Is this coming from my firewall (Firestarter) somehow?  If so, why??
> 64.105.56.109 is my IP, but I don't know what the other one is
> 64.105.106.5) Thanks - John
>
> Appears on console screen, over and over, but not on remote ssh
> screen:
>
> IN=eth0) OUT= MAC= 00:c0:9f:38:15:eb:00:e0:eb:74:7f:C8:08:00:
> SRC=64.105.106.5 DST=64.105.56.109 LEN=48 TOS=0x00 PREC=0x00 TTL=119
> ID=9735 DF PROTO=TCP SPT= 2074 DPT=135 WINDOW=65280 RES=0x00 SYN
> URGP=0

Someone's trying to connect to your machine on port 135. Isn't this the
port the RPC service on windows runs? Could be some virus trying to
find some Windows box.

Thanks - I do have one Windows box on my LAN - Here is another reason to
take it off.  Actually, I can boot it into Linux and see if the problem goes
away.  That other IP above is -not- the Windows box though.  Maaybe
something's coming through the Windows box FROM that other IP?  The Windows
box is connected to a NAT router connected to my main router that my
server's plugged into.  It's a real pain because it's difficult to work in
the console when the screen is cluttered all the time with all those msgs.
FWIW, I didn't have those messages when I was using Debian Unstable with the
same firewall and router configuration. - John