Now I'm sort of worried..
The dodgy network activity that occured around 9am yesterday morning
happened again after midday yesterday too, from the same host. Here's
what logcheck mailed me this morning:
Mar 13 12:47:13 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
<MY_IP>:64982 L=44 S=0x00 I=32299 F=0x0000 T=51
Mar 13 12:47:16 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
<MY_IP>:64982 L=44 S=0x00 I=32308 F=0x0000 T=51
Mar 13 12:47:22 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
<MY_IP>:64982 L=44 S=0x00 I=32362 F=0x0000 T=51
Mar 13 12:47:34 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
<MY_IP>:64982 L=44 S=0x00 I=32428 F=0x0000 T=51
Mar 13 12:47:37 mail kernel: IP fw-in deny eth0 ICMP/3 216.15.159.194
<MY_IP> L=68 S=0xC0 I=32438 F=0x0000 T=51
Mar 13 12:47:41 mail kernel: IP fw-in deny eth0 ICMP/3 216.15.159.194
<MY_IP> L=68 S=0xC0 I=32455 F=0x0000 T=51
Mar 13 12:47:47 mail kernel: IP fw-in deny eth0 ICMP/3 216.15.159.194
<MY_IP> L=68 S=0xC0 I=32486 F=0x0000 T=51
Mar 13 12:47:52 mail kernel: IP fw-in deny eth0 ICMP/3 216.15.159.194
<MY_IP> L=68 S=0xC0 I=32503 F=0x0000 T=51
Mar 13 12:47:57 mail kernel: IP fw-in deny eth0 ICMP/3 216.15.159.194
<MY_IP> L=68 S=0xC0 I=32520 F=0x0000 T=51
Mar 13 12:47:58 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
<MY_IP>:64982 L=44 S=0x00 I=32525 F=0x0000 T=51
Mar 13 12:48:01 mail kernel: IP fw-in deny eth0 ICMP/3 216.15.159.194
<MY_IP> L=68 S=0xC0 I=32532 F=0x0000 T=51
Mar 13 12:48:06 mail kernel: IP fw-in deny eth0 ICMP/3 216.15.159.194
<MY_IP> L=68 S=0xC0 I=32549 F=0x0000 T=51
Mar 13 12:48:11 mail kernel: IP fw-in deny eth0 ICMP/3 216.15.159.194
<MY_IP> L=68 S=0xC0 I=32556 F=0x0000 T=51
Mar 13 12:48:17 mail kernel: IP fw-in deny eth0 ICMP/3 216.15.159.194
<MY_IP> L=68 S=0xC0 I=32573 F=0x0000 T=51
Mar 13 12:48:46 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
<MY_IP>:64982 L=44 S=0x00 I=32679 F=0x0000 T=51
Mar 13 12:50:22 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
<MY_IP>:64982 L=44 S=0x00 I=32833 F=0x0000 T=51
I included their IP this time, it resolves to "samantha.craghead.com"
and a traceroute to it gets as far as cybercon-gw.customer.dbn.net
(209.251.164.198).
Can anyone shed any light on what they're doing? (are they trying to get
at my httpd server on the last two lines?)
Donncha.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
