Re: mystery martian source from 127.0.0.1

On Wed, 07 Dec 2005, in the Usenet newsgroup comp.os.linux.security, in article
<dn7gjn$b54$1@xxxxxxxxxxxxxxx>, EricT wrote:

>xx:xx:xx:xx:xx:xx is the HWAddr of eth0, the rest of the header
>(00:09:7b:8d:98:70:08:00) is absolutly unknown to me.

[compton ~]$ etherwhois 00:09:7b
00-09-7B (hex) Cisco Systems
00097B (base 16) Cisco Systems
80 West Tasman Dr.
SJ-M/1
San Jose CA 95134
UNITED STATES
[compton ~]$

Probably your cable modem or DSL router. You'd have to look at the TTLa
to see if that's the source, or the crap is really coming from "outside".

>the traffic is coming from 127.0.0.1:80 (referring to tcpdump).
>Unfortunatly, i cannot post any output of tcpdump, since these messages
>(packets) occur arbitrary.

man tcpdump and look at the filtering algorithms. Something like

tcpdump -i eth0 src host 127.0.0.1 -s 1500 -vv

Old guy

.

Relevant Pages

  • Re: mystery martian source from 127.0.0.1
    ... > Probably your cable modem or DSL router. ... You'd have to look at the TTLa ... > to see if that's the source, or the crap is really coming from "outside". ...
    (comp.os.linux.security)
  • Re: Snoop or tcpdump
    ... Please check the Internet Express DVD in your HPUX media. ... i dont know crap about HPUX...but i do know about other Unix platforms, ... What i need to know is if tcpdump or snoop has a native equilivent on ...
    (comp.sys.hp.hpux)
  • arp on cable modems
    ... Is there any rule in pf to dump this crap? ... tcpdump just shows streams of this stuff!! ...
    (freebsd-questions)