From owner-freebsd-stable Fri Aug 3 2:34: 3 2001 Delivered-To: freebsd-stable@freebsd.org Received: from femail12.sdc1.sfba.home.com (femail12.sdc1.sfba.home.com [24.0.95.108]) by hub.freebsd.org (Postfix) with ESMTP id DFAB037B406 for ; Fri, 3 Aug 2001 02:33:58 -0700 (PDT) (envelope-from tsikora@home.com) Received: from home.com ([24.2.168.186]) by femail12.sdc1.sfba.home.com (InterMail vM.4.01.03.20 201-229-121-120-20010223) with ESMTP id <20010803093357.ODSC19709.femail12.sdc1.sfba.home.com@home.com> for ; Fri, 3 Aug 2001 02:33:57 -0700 Message-ID: <3B6A7025.A5F8643F@home.com> Date: Fri, 03 Aug 2001 05:34:29 -0400 From: Ted Sikora Organization: Jtl Development Group X-Mailer: Mozilla 4.77 [en] (X11; U; Linux 2.2.12 i386) X-Accept-Language: en-US,en-GB MIME-Version: 1.0 To: "freebsd-stable@FreeBSD.ORG" Subject: Re: Bridge? References: <03f501c11bc9$fec84a00$0300a8c0@laptop> Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Mike Porter wrote: > > -----Original Message----- > From: Ted Sikora > To: freebsd-stable@FreeBSD.ORG > Date: Thursday, August 02, 2001 10:35 AM > Subject: Re: Bridge? > > >Ted Sikora wrote: > >> > >> I have stable on both cable and dsl. The following message (rpc.statd: > >> invalid hostname to sm_stat: ^X÷ÿ¿^X÷ÿ¿^) > >> has been a mainstay in stable for some time. I have 2 nic cards in the > >> machines. Do I need the 'options BRIDGE' in the kernel? I just set up a > >> firewall and that did not eliminate the messages. > >> > > > >That was it. I guess the Bridge option is needed with cable and dsl > >modems. > > > > Well geezs if that's all I have to do.... > > I have been getting those, but I thought it was related to, being on cable, > someone trying a windoze exploit. (smb_stat==something related to > samba/windows networkng (SMB), at least in my mind...) > Ha! an old one is back: Aug 2 20:07:36 dhcp-209-54-72-117 /kernel: arp: 192.168.1.1 is on ed0 but got reply from 00:20:78:d4:a5:87 on dc0 *********************************** WHO IS THIS?? *********************************** Aug 2 20:08:02 dhcp-209-54-72-117 last message repeated 2 times Aug 2 20:10:00 dhcp-209-54-72-117 last message repeated 8 times I checked all my mac addreses .. IT'S NOT ON MY NETWORK! Unfortunately I was using 192.168.1.1 I changed the network addresses and so far it's quiet. That da** cable modem must be letting other users in from my node.?? I had this on one of my machines an attack?? Aug 2 10:03:08 dhcp-209-54-72-114 ftpd[424]: refused PORT 9.100.139.211,1195 from sungold10.fr.ibm.com [194.196.100.115] Aug 2 10:25:20 dhcp-209-54-72-114 ftpd[466]: refused PORT 9.100.139.211,1213 from sungold10.fr.ibm.com [194.196.100.115] Aug 2 10:45:15 dhcp-209-54-72-114 ftpd[479]: francess@fr.ibm.com of sungold4.fr.ibm.com [194.196.100.100]: data connect from 194.196.100.101 for /bin/ls Aug 2 10:45:22 dhcp-209-54-72-114 ftpd[479]: francess@fr.ibm.com of sungold4.fr.ibm.com [194.196.100.100]: data connect from 194.196.100.101 for /bin/ls Aug 2 10:46:12 dhcp-209-54-72-114 ftpd[485]: francess@fr.ibm.com of sungold5.fr.ibm.com [194.196.100.101]: data connect from 194.196.100.114 for /bin/ls Aug 2 10:47:01 dhcp-209-54-72-114 ftpd[487]: francess@fr.ibm.com of sungold9.fr.ibm.com [194.196.100.114]: data connect from 194.196.100.113 for /bin/ls Aug 2 10:47:58 dhcp-209-54-72-114 ftpd[489]: francess@fr.ibm.com of sungold10.fr.ibm.com [194.196.100.115]: data connect from 194.196.100.99 for /bin/ls Aug 2 10:48:04 dhcp-209-54-72-114 ftpd[489]: francess@fr.ibm.com of sungold10.fr.ibm.com [194.196.100.115]: data connect from 194.196.100.101 for /bin/ls and it goes on.............. -- Ted Sikora tsikora@ntplx.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message