Re: Alert from kernel

From: stephen@acgroup.ucsc.edu
Date: 08/18/01

Previous message: Rob 'Feztaa' Park: "Firewalling"
In reply to: Prakash Purushotham: "Alert from kernel"
Next in thread: Jin Mao: "Re: strange connection on port 111.. more question"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Fri, 17 Aug 2001 17:12:05 -0700 (PDT)
From: <stephen@acgroup.ucsc.edu>
To: Prakash Purushotham <ppuru@yahoo.com>
Subject: Re: Alert from kernel
Message-ID: <Pine.GSO.4.31.0108171711290.11072-100000@cavecanem.ucsc.edu>

They look like reverse lookups for hostnames (as in sendmail)
and they are rejected because they don't exit.

I don't think this is any hack attempt.

Stephen Hauskins
Academic Computing Group
Natural Sciences Division

Omnia iam fient fieri quae posse negabam

On Fri, 17 Aug 2001, Prakash Purushotham wrote:

> All
>
> I found the following messages in the system logs
>
> Aug 17 10:39:05 xxxxxx kernel: IP_MASQ:reverse ICMP: failed
> checksum from 203.126.27.196!
> Aug 17 10:39:14 xxxxxx kernel: IP_MASQ:reverse ICMP: failed
> checksum from 203.126.27.196!
> Aug 17 10:39:23 xxxxxx kernel: IP_MASQ:reverse ICMP: failed
> checksum from 203.120.44.8!
>
> Any clues what these could mean?
>
> RHL 7.0, 2.2.17-14, ipchains
>
> ICMP
> echo out, echo reply allowed
> destination unreachable, parameter problem, source quench, time
> exceeded are allowed both ways.
>
> ingress and egress filtered using rp_filter and ipchains rules.
>
> Prakash
>
>
>
> __________________________________________________
> Do You Yahoo!?
> Make international calls for as low as $.04/minute with Yahoo! Messenger
> http://phonecard.yahoo.com/
>

Previous message: Rob 'Feztaa' Park: "Firewalling"
In reply to: Prakash Purushotham: "Alert from kernel"
Next in thread: Jin Mao: "Re: strange connection on port 111.. more question"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

Alert from kernel
... checksum from 203.126.27.196! ... echo out, echo reply allowed ... ingress and egress filtered using rp_filter and ipchains rules. ... Make international calls for as low as $.04/minute with Yahoo! ...
(Focus-Linux)
Re: inconsistent downloads, or bugs?
... With md5 you can check the checksum on your ... system with that given on ftp mirror site from which ... > Use firefox and also do not download using http. ... > Do you Yahoo!? ...
(Debian-User)
Re: md5 differences
... Arno@Computer:~% echo "hello" | md5 ... Checksum the same string. ...
(comp.lang.python)