1 Feb
2012
1 Feb
'12
9:31 p.m.
Ok, ran tcpdump with the following result:
$ sudo tcpdump -vpni eth0 'src net 212.13.194.0/23 and not arp'
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96
bytes
21:14:44.610567 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP
(6), length 52)
212.13.195.254.80 > 180.76.5.52.34209: Flags [S.], cksum 0x2eb3
(correct), seq 1882408364, ack 2442136209, win 5840, options [mss
1460,nop,nop,sackOK,nop,wscale 6], length 0
21:14:44.916894 IP (tos 0x0, ttl 64, id 18695, offset 0, flags [DF], proto
TCP (6), length 40)
212.13.195.254.80 > 180.76.5.52.34209: Flags [.], cksum 0x84f9
(correct), ack 240, win 108, length 0
[...]
21:14:47.691019 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP
(6), length 60)
212.13.195.254.80 > 66.249.72.20.49028: Flags [S.], cksum 0x3588
(correct), seq 4123153607, ack 62604846, win 5792, options [mss
1460,sackOK,TS val 918884192 ecr 696390848,nop,wscale 6], length 0
I see the same few IPs in the destination, and I looked them up: Baidu and
Google. I take it these are "scans"? It seems like a lot of communication
going on. But if that's the only traffic, am I'm only facing a drop in
search ranking if I delete that IP?
On Tue, Jan 31, 2012 at 4:17 PM, Andy Smith <andy(a)bitfolk.com> wrote:
Hi Michael,
On Tue, Jan 31, 2012 at 04:01:08PM -0600, Michael Corliss wrote:
After making sure that my VPS is receiving
packets on the right address,
I'm now getting warnings that it's sending on the old address.
I had a look at what was caught for you and it was just 9 packets,
split between source port 443 and source port 53. Probably just
scans.
So I wouldn't be too concerned.
To my knowledge I don't have any software
installed for which I
needed to specify the VPS' IP, so my guess is that this will end
when I remove the old address from network/interfaces. Is that
right?
You will definitely not be able to send packets from an IP address
you have removed¹. ;)
Is there a way to test before deleting the old
IP?
# tcpdump -vpni eth0 'src net 212.13.194.0/23 and not arp'
will show you any traffic going in or out of your eth0 that has a
source address inside 212.13.194.0/23 and is not ARP traffic.
Cheers,
Andy
¹ OK yeah barring some crafty thing you do to generate such traffic.
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users