[linux] Flood hack ?? podivne spravanie // arp who-has 500x/1sekunda

[Peter Surda]

Jan Kunder schrieb:

> Ahoj

ahoj

> Chcel by som sa spytat na IMHO abnormalne spravanie sa v sieti.

[cut]

> 18:31:31.294356 arp who-has chello085216166124.chello.sk tell 
> chello085216160001.chello.sk
> 18:31:31.301249 arp who-has chello085216165170.chello.sk tell 
> chello085216160001.chello.sk
> 18:31:31.313380 arp who-has chello085216164224.chello.sk tell 
> chello085216163174.chello.sk
> 18:31:31.313660 arp who-has chello085216165086.chello.sk tell 
> chello085216163174.chello.sk

Je to typickym prejavom roznych cervov, tie posielajuce pocitace su s 
velkou pravdepodobnostou niecim infikovane. Robia to aj niektore 
"legitimne" programy na zdielanie suborov (jeden z nich sa myslim vola 
sharescan).

S pozdravom,
Peter

-- 
http://www.shurdix.org - Linux distribution for routers and firewalls