[AYUDA] Re: Tal vez tenga un Intruso en la red

Miguel Cardenas warlockxxi en yahoo.com
Jue Mayo 15 09:04:44 CDT 2008


Hola

El 2wire es una porqueria, no se exactamente a que se deba tu problema pero hasta donde se el 2wire puede ser reprogramado DESDE AFUERA, telmex le puede mover a tu configuracion e incluso cambiarte el password en el router, ignoro como lo hagan pero es un hecho que lo hacen para "actualizarte" o "desactivar tu conexion" cuando pagas mas barato con bandwidth mensual limitado y lo rebasas (muy chafa solucion por cierto, pero te estan accesando del exterior y si ellos pueden teoricamente cualquiera tambien).

Por otro lado tiene agujeros de seguridad que lo hacen ver muy pi...ñata, no tengo la direccion a mano donde esta el reporte de seguridad sobre el 2wire realizado por la UNAM (tambien encuentras mas referencias en google), otra tecnica ataca tu router DESDE ADENTRO DE TU PROPIA RED, te llega el clasico mail de que ganaste un premio, el de viejas en canicas, el mas bobo de que recibiste una tarjeta (particularmente de gusanito.com) o cualquier cosa curiosa, estos no te envian un archivo EXE oculto como los virus, de hecho te muestran realmente un articulo informativo o tarjeta animada como si fuera real, pero tiene codigo oculto detras que envia comandos al 2wire (via http://...) ya desde tu red local desde tu propio navegador y lo reconfigura, cambia el password de acceso al router, agrega entradas estaticas en el area de DNS (sobre todo con dominios de bancos) que hacen "override" de la resolucion DNS y toma la ip de esta lista... Esto no tiene
 solucion, cualquiera que navegue y abra un sitio que contenga este tipo de codigo oculto modificara la configuracion (incluso abrir puertos, cualquier cosa hasta donde se), si es una red de trabajo la mejor opcion es revisar todos los dias la configuracion del 2wire y echarle un ojo a los logs del router, nimodo asi es esto :-/

En fin es una porqueria, yo ando juntando una lanita para comprar otro mejorcito o de perdida "menos peor" pues las referencias de 2wire lo pintan como de lo mas chafa que hay...

Supongo que esto no es la causa de tu problema para este caso particular pero igual hay que tenerlo en cuenta.

Saludos y suerte

----- Original Message ----
From: Gustavo Guillermo Perez <gustavo en compunauta.com>
To: ayuda-linux en googlegroups.com
Sent: Wednesday, May 14, 2008 1:32:36 PM
Subject: [AYUDA] Tal vez tenga un Intruso en la red


Les comento algo raro que observo en el log de mi servidor, tengo un router en 
la 3er red con la ip 192.168.3.254, el servidor tiene las direcciones IP 
192.168.1.1 192.168.2.1 192.168.3.1, los tres cables de esas tarjetas de red 
van a los mismos switchs no están físicamente separados,

http://ulinux.no-ip.org:8080/gusgus/fotolog/proyectos/intruso/ifconfig.txt

el servicio DHCP provee direcciones ip a la red 1 y a una sola PC de la red 2 
por medio del archivo dhcpd.conf.

http://ulinux.no-ip.org:8080/gusgus/fotolog/proyectos/intruso/dhcpd.conf

El router es un 2wire de Telmez y en la red de area local detecta una PC sin 
dirección ip asignada.

http://ulinux.no-ip.org:8080/gusgus/fotolog/proyectos/intruso/Resumen_1210788317312.png

desactivé la red inalámbrica y el router no tiene DHCP activado.

La dirección mac del 2wire es la misma que aparece en el syslog

http://standards.ieee.org/regauth/oui/oui.txt

00-1B-5B   (hex)        2Wire, Inc.
001B5B     (base 16)        2Wire, Inc.
                1704 Automation Parkway
                San Jose CA 95131
                UNITED STATES
Revisando las direcciones asignadas con la dirección MAC coincide con 2wire

http://ulinux.no-ip.org:8080/gusgus/fotolog/proyectos/intruso/syslog.txt

Las direcciones IP de la red 3 no deberían existir más que la 192.168.3.3 que 
es la que uso para entrar al router desde una PC con dos tarjetas de red.


Así que no creo que haya intrusos intentando usar el router, sino que el 
router está enviando paquetes de algún tipo a la red interna, desactivando 
dhcp detecto en una de las máquinas un paquete enviado por el 2wire 
relacionado con dhclient. 

Voy a repetir el proceso para ver y capturar ese paquete, ustedes que creen?


-----------------------------------------------------------------------------
tian source 192.168.3.2 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 13 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 7 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
printk: 35 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
printk: 15 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 7 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 33 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59458 DF PROTO=TCP 
SPT=80 DPT=1138 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 19 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59460 DF PROTO=TCP 
SPT=80 DPT=29447 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59461 DF PROTO=TCP 
SPT=80 DPT=4216 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59463 DF PROTO=TCP 
SPT=80 DPT=26450 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 7 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
printk: 23 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
printk: 27 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59482 DF PROTO=TCP 
SPT=80 DPT=11704 WINDOW=0 RES=0x00 ACK RST URGP=0 
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59485 DF PROTO=TCP 
SPT=80 DPT=16326 WINDOW=0 RES=0x00 ACK RST URGP=0 
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59486 DF PROTO=TCP 
SPT=80 DPT=2293 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 7 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 21 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=63.210.142.9 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59506 DF PROTO=TCP 
SPT=80 DPT=16659 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 31 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
usb 3-2: new low speed USB device using ohci_hcd and address 2
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
usb 3-2: configuration #1 chosen from 1 choice
input: USB Advance  Mouse as /class/input/input7
usbcore: registered new interface driver usbkbd
drivers/hid/usbhid/usbkbd.c: :USB HID Boot Protocol keyboard driver
usbcore: registered new interface driver hiddev
input: USB Advance  Mouse as /class/input/input8
input,hidraw0: USB HID v1.10 Mouse [USB Advance  Mouse] on usb-0000:00:03.2-2
usbcore: registered new interface driver usbhid
drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 7 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 11 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
printk: 39 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59516 DF PROTO=TCP 
SPT=80 DPT=25060 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59521 DF PROTO=TCP 
SPT=80 DPT=4626 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 7 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
printk: 37 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=63.210.142.15 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=59527 DF PROTO=TCP 
SPT=80 DPT=7983 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 11 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-ACC-TCP IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=66.98.86.232 
DST=192.168.3.1 LEN=48 TOS=0x08 PREC=0x00 TTL=109 ID=18687 DF PROTO=TCP 
SPT=49642 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B401010402) 
SuSE-FW-INext-DROP-DEFLT IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=66.98.86.232 
DST=192.168.3.1 LEN=43 TOS=0x00 PREC=0x00 TTL=109 ID=18689 PROTO=UDP 
SPT=49644 DPT=28795 LEN=23 
SuSE-FW-INext-DROP-DEFLT IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=66.98.86.232 
DST=192.168.3.1 LEN=43 TOS=0x00 PREC=0x00 TTL=109 ID=18691 PROTO=UDP 
SPT=49644 DPT=28795 LEN=23 
SuSE-FW-INext-DROP-DEFLT IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=66.98.86.232 
DST=192.168.3.1 LEN=43 TOS=0x00 PREC=0x00 TTL=109 ID=18692 PROTO=UDP 
SPT=49644 DPT=28795 LEN=23 
printk: 9 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 33 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
printk: 21 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 7 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=5929 DF PROTO=TCP SPT=80 
DPT=9485 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 25 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=208.111.159.49 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=5941 DF PROTO=TCP SPT=80 
DPT=8636 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 23 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=208.101.32.192 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=5963 DF PROTO=TCP SPT=80 
DPT=29303 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 7 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 21 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
printk: 33 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=5998 DF PROTO=TCP SPT=80 
DPT=8808 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 7 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 13 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=6016 DF PROTO=TCP SPT=80 
DPT=5248 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 35 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth0
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-OUT-ERROR IN= OUT=eth1 SRC=192.168.2.1 DST=192.168.2.127 LEN=40 
TOS=0x00 PREC=0x00 TTL=64 ID=380 DF PROTO=TCP SPT=3128 DPT=2832 WINDOW=9549 
RES=0x00 ACK FIN URGP=0 
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
SuSE-FW-INext-DROP-DEFLT-INV IN=eth2 OUT= 
MAC=00:60:6e:70:1f:d5:00:1b:5b:a5:9b:b9:08:00 SRC=132.248.181.148 
DST=192.168.3.1 LEN=40 TOS=0x08 PREC=0x00 TTL=255 ID=6033 DF PROTO=TCP SPT=80 
DPT=21483 WINDOW=0 RES=0x00 ACK RST URGP=0 
printk: 7 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
printk: 39 messages suppressed.
martian source 192.168.1.255 from 192.168.1.1, on dev eth2
ll header: ff:ff:ff:ff:ff:ff:00:16:ec:84:6f:9d:08:00
printk: 13 messages suppressed.
martian source 192.168.3.1 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 5 messages suppressed.
martian source 192.168.3.2 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.71 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06
printk: 9 messages suppressed.
martian source 192.168.3.155 from 192.168.3.254, on dev eth1
ll header: ff:ff:ff:ff:ff:ff:00:1b:5b:a5:9b:b9:08:06

ifconfig en el server
eth0      Link encap:Ethernet  HWaddr 00:16:EC:84:6F:9D  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::216:ecff:fe84:6f9d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:627815 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1012991 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:54988539 (52.4 Mb)  TX bytes:1448920675 (1381.7 Mb)
          Interrupt:19 Base address:0xe000 

eth1      Link encap:Ethernet  HWaddr 00:60:6E:70:1F:B1  
          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::260:6eff:fe70:1fb1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:36996 errors:0 dropped:0 overruns:0 frame:0
          TX packets:26891 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6507749 (6.2 Mb)  TX bytes:22470554 (21.4 Mb)
          Interrupt:17 Base address:0xe400 

eth2      Link encap:Ethernet  HWaddr 00:60:6E:70:1F:D5  
          inet addr:192.168.3.1  Bcast:192.168.3.255  Mask:255.255.255.0
          inet6 addr: fe80::260:6eff:fe70:1fd5/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1018239 errors:0 dropped:0 overruns:0 frame:0
          TX packets:765511 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1445692256 (1378.7 Mb)  TX bytes:74486907 (71.0 Mb)
          Interrupt:18 Base address:0xe800 

-- 
Gustavo Guillermo Pérez
Compunauta uLinux
www.compunauta.com



      

--~--~---------~--~----~------------~-------~--~----~
Has recibido este mensaje porque estás suscrito a Grupo "ayuda-linux"
de Grupos de Google.
Si quieres publicar en este grupo, envía un mensaje de correo
electrónico a ayuda-linux en googlegroups.com
Para anular la suscripción a este grupo, envía un mensaje a
ayuda-linux-unsubscribe en googlegroups.com
Para obtener más opciones, visita este grupo en
http://groups.google.es/group/ayuda-linux?hl=es. o http://www.compunauta.com/ayuda/
-~----------~----~----~----~------~----~------~--~---




Más información sobre la lista de distribución Ayuda