Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 26 Mar 2004 15:55:13 +0100
From:      Ruben de Groot <mail25@bzerk.org>
To:        "Matt Coe, CCNA" <webmaster@jargonccna.cjb.net>
Cc:        freebsd-questions@freebsd.org
Subject:   Re: Bandwidth hit in natd/ipfw on 4.4-RELEASE
Message-ID:  <20040326145513.GD4741@ei.bzerk.org>
In-Reply-To: <406441AC.6080707@jargonccna.cjb.net>
References:  <200403260324.i2Q3O4f0032739@mail.cjb.net> <20040326141935.GB4741@ei.bzerk.org> <406441AC.6080707@jargonccna.cjb.net>

next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Mar 26, 2004 at 10:43:56AM -0400, Matt Coe, CCNA typed:
> Ruben de Groot wrote:
> 
> >4.4-RELEASE is quite old. Have you considered the possibility that you
> >got rooted?
> > 
> >
> I'm sure it's /possible/, but extraordinarily unlikely. The server's 
> only been three days and I'm on a university resnet; I'd guess that no 
> port below 1024 is accessible from outside my house.. and the most 
> computer-literate people in this house are either Counter-Strike addicts 
> or me. There are very few Computer Science students in this house, and 
> I'm probably the only person who actively uses something other than 
> WinXP or MacOS X.

So maybe *they* got infected by some bandwidth-hungry virus/trojan/worm ?

Seriously, have you tried investigating (netstat/sockstat/tcpdump are
all good tools for this) what exactly is consuming so much bandwidth
on your system?

Ruben



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040326145513.GD4741>