Date: Sun, 11 Apr 2010 07:10:50 -0500 From: Walter <walterk1@earthlink.net> To: Adam Vande More <amvandemore@gmail.com> Cc: Questions <freebsd-questions@freebsd.org> Subject: Re: host & dig Message-ID: <4BC1BC4A.40605@earthlink.net> In-Reply-To: <w2z6201873e1004100914pf6cc9335z2133cbad172825cb@mail.gmail.com> References: <4BC0911E.2090703@earthlink.net> <w2z6201873e1004100914pf6cc9335z2133cbad172825cb@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Adam Vande More wrote:
I used telnet to connect to 68.204.xxx.xxx
it tells me I've connected to [1]xxx.xxx.204.68.cfl.res.rr.com.
(backwards, right?), then I log in.
No, you have to a connection before you login. You want to *strongly*
consider using ssh instead of telnet. You may also be referring the
format of the DNS query result which known as
[2]http://en.wikipedia.org/wiki/Reverse_DNS_lookup
I DID have a connection. ??? Maybe I gave too much detail,
but the point is that the IP yielded by host/dig did not match
what "whatismyip.com" gave here. I'd like to know why.
After user/pass entry, it says connected from "user-yyyyyyy.cab"
(replaced seemingly random name with "yyyyyyy" in case
it's not transient)
My external IP here is 24.110.nnn.nnn
The issue:
When I use either "host" or "dig" to give me the IP address
from "user-yyyyyyy.cab", they tell me: 208.68.zzz.zzz
(Ping gives the same.)
So, I'm still at a loss, I think, to know the originating IP.
Should a firewall rule blocking 208.68.zzz.zzz actually
operate against 24.110.nnn.nnn?
I don't understand the question, what is the rule?
I'd STILL like to know the true source IP to be able to connect
back to it.
man sockstat
man netstat
Thanks. Did that:
"netstat -n" gives the correct IP.
"sockstat" does also.
I couldn't find anything in the host or dig man pages that
indicated to me that they could be made to yield the proper
24.110.*.* IP address.
About the "rule"::: I was just mentioning one of the reasons
I want the IP address is so I can monitor multiple bad login
attempts to block the troublesome IP with a firewall rule. I
ALSO would like the correct IP for another purpose (project),
that involves connecting back to the source IP.
I will give a try to find out which IP address the ipfw firewall
operates on - the 208.68.*.* one or the 24.110.*.* one. It's not
obvious which at this point to me.
Thanks.
Walter
References
1. http://xxx.xxx.204.68.cfl.res.rr.com/
2. http://en.wikipedia.org/wiki/Reverse_DNS_lookup
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4BC1BC4A.40605>