From owner-freebsd-questions Tue Mar 28 13:24:24 2000 Delivered-To: freebsd-questions@freebsd.org Received: from hotmail.com (f200.law8.hotmail.com [216.33.241.200]) by hub.freebsd.org (Postfix) with SMTP id E0A9937BA8E for ; Tue, 28 Mar 2000 13:24:19 -0800 (PST) (envelope-from hjeffrey@hotmail.com) Received: (qmail 44270 invoked by uid 0); 28 Mar 2000 21:24:18 -0000 Message-ID: <20000328212418.44269.qmail@hotmail.com> Received: from 130.11.112.22 by www.hotmail.com with HTTP; Tue, 28 Mar 2000 13:24:18 PST X-Originating-IP: [130.11.112.22] From: "Jeff Hamilton" To: dwmalone@maths.tcd.ie Cc: freebsd-questions@freebsd.org, freebsd-stable@freebsd.org Subject: Re: /etc/hosts.allow Date: Tue, 28 Mar 2000 13:24:18 PST Mime-Version: 1.0 Content-Type: text/plain; format=flowed Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG >From: David Malone >To: Jeff Hamilton >CC: freebsd-questions@freebsd.org, freebsd-stable@freebsd.org >Subject: Re: /etc/hosts.allow >Date: Tue, 28 Mar 2000 21:14:12 +0100 > >On Tue, Mar 28, 2000 at 09:47:43AM -0800, Jeff Hamilton wrote: > > > Mar 28 17:37:54 hostname portmap[154]: warning: /etc/hosts.allow, line >16: > > twist_option: dup: Bad file descriptor > > > > What am I doing wrong, or is this message expected? > >My guess is that the portmapper is getting a tcp connection, which the >remote end closes almost immediately. Then when the wrapping code goes >to to dup the discriptor which is supposed to be connected it finds it >is unconnected. Could this possibly be an indicator of a port scan or other exploit attempt? Is there anyway to trace the IP address that originated the connection? Thanks. Jeff hjeffrey@hotmail.com ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message