From owner-freebsd-isp Tue Apr 24 15:18:14 2001 Delivered-To: freebsd-isp@freebsd.org Received: from velvet.sensation.net.au (serial1-2-velvet-brunswick.sensation.net.au [203.20.114.195]) by hub.freebsd.org (Postfix) with ESMTP id 6C4AD37B42C for ; Tue, 24 Apr 2001 15:18:08 -0700 (PDT) (envelope-from rowan@sensation.net.au) Received: from localhost (rowan@localhost) by velvet.sensation.net.au (8.9.3/8.9.3) with ESMTP id IAA27301 for ; Wed, 25 Apr 2001 08:17:51 +1000 (EST) (envelope-from rowan@sensation.net.au) X-Authentication-Warning: velvet.sensation.net.au: rowan owned process doing -bs Date: Wed, 25 Apr 2001 08:17:48 +1000 (EST) From: Rowan Crowe To: freebsd-isp@freebsd.org Subject: Re: IPFW ? hacked? In-Reply-To: <006301c0ccf5$4a5e4600$c800a8c0@aspenworks.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Tue, 24 Apr 2001, alex huppenthal wrote: > I setup a pipe - number 5, and set the bandwidth to 20Mbits. > > Interestingly, I see 205.149.189.91 as a destination IP address at port 5999 > collecting data from x.x.18.3 > > I don't know 205.149.189.91 or have any process running to that site. > However, the numbers are increasing. > > Anyone seen this behavior? > > 00005: 20.000 Mbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail > mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 > BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte > Drp > 0 tcp x.x.18.3/1027 205.149.189.91/5999 76043 19344253 0 0 > 0 Yes. I experimented with 4.x dummynet shaping on a popular web site, and it seems the first IP:port to run through the pipe gets shown, as above, for the life of that pipe. The byte/packet count is NOT specific to that single IP:port, it's everything travelling through the pipe. I'm not sure why this display is considered useful (?). If you delete and redo the pipe you'll probably get a different IP showing, so I wouldn't be too concerned about it... do some local testing with known IPs if you want to follow it up further? Cheers. -- Rowan Crowe http://www.rowan.sensation.net.au/ Sensation Internet Services http://info.sensation.net.au/ Melbourne, Australia Phone: +61-3-9388-9260 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message