I have a suspicion this is a rouge dhcp as well. See if you can lease a
192 address or set to a static. I bet if you connect to the dhcp device
in a browser (192.168.1.1) that should give you an idea of what type of
device you are looking for.
Good luck,
James
-----Original Message-----
From: Bozovic, Milos [mailto:milos@arts.si]
Sent: Thursday, June 16, 2005 11:28 AM
To: A Riaz; security-basics@securityfocus.com
Subject: RE: Is it hacking?
Hello!
Just a quick thought. Is it possible that someone inadvertently
connected some kind of DSL router or print server with DHCP server
capabilities to the network? Also, do you use dhcp on the network or
static IPs for your computers? The IP you're mentioning is in common
range of default installations for some of these devices.
Kind regards,
Milos
-----Original Message-----
From: A Riaz [mailto:ariaz1949@hotmail.com]
Sent: Thursday, June 16, 2005 11:11 AM
To: jfountain@rbinc.com; security-basics@securityfocus.com
Subject: RE: Is it hacking?
Jenn,
Thanks for your response. Our network is 10.0.0.255. A machine with IP
192.168.1.251 shouldn't exist.
I think I should also check if any machine on the network is infected
with
some virus or trojan.
Thanks,
AR
From: "Jennifer Fountain" <jfountain@rbinc.com>
To: "A Riaz"
<ariaz1949@hotmail.com>,<security-basics@securityfocus.com>
Subject: RE: Is it hacking?
Date: Wed, 15 Jun 2005 20:10:22 -0400
To disable the error being logged by the kernel changing the following
line:
echo 1 >/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
From what I can tell, these aren't usually a result of an attack (but
others will probably have more information.)
But things to check - Is this IP on your network? Could there be a
problem with that machine?
HTH
-Jenn
-----Original Message-----
From: A Riaz [mailto:ariaz1949@hotmail.com]
Sent: Wednesday, June 15, 2005 11:38 AM
To: security-basics@securityfocus.com
Cc: ariaz1949@hotmail.com
Subject: Is it hacking?
Hello everyone,
I'm getting the following entery in the message log every 5 mins:
kernel: 192.168.1.251 sent an invalid ICMP error to a broadcast.
I'm running Redhat Linux 9. Is it an attempt to hack into the system?
Any advice?
Thanks,
AR
_________________________________________________________________
Don't just search. Find. Check out the new MSN Search!
http://search.msn.click-url.com/go/onm00200636ave/direct/01/
_________________________________________________________________
Don't just search. Find. Check out the new MSN Search!
http://search.msn.click-url.com/go/onm00200636ave/direct/01/
