tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
21:14:44.610567 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
212.13.195.254.80 > 180.76.5.52.34209: Flags [S.], cksum 0x2eb3 (correct), seq 1882408364, ack 2442136209, win 5840, options [mss 1460,nop,nop,sackOK,nop,wscale 6], length 0
21:14:44.916894 IP (tos 0x0, ttl 64, id 18695, offset 0, flags [DF], proto TCP (6), length 40)
212.13.195.254.80 > 180.76.5.52.34209: Flags [.], cksum 0x84f9 (correct), ack 240, win 108, length 0
[...]
21:14:47.691019 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
212.13.195.254.80 > 66.249.72.20.49028: Flags [S.], cksum 0x3588 (correct), seq 4123153607, ack 62604846, win 5792, options [mss 1460,sackOK,TS val 918884192 ecr 696390848,nop,wscale 6], length 0
I see the same few IPs in the destination, and I looked them up: Baidu and Google. I take it these are "scans"? It seems like a lot of communication going on. But if that's the only traffic, am I'm only facing a drop in search ranking if I delete that IP?
On Tue, Jan 31, 2012 at 4:17 PM, Andy Smith
<andy@bitfolk.com> wrote:
Hi Michael,
On Tue, Jan 31, 2012 at 04:01:08PM -0600, Michael Corliss wrote:
> After making sure that my VPS is receiving packets on the right address,
> I'm now getting warnings that it's sending on the old address.
I had a look at what was caught for you and it was just 9 packets,
split between source port 443 and source port 53. Probably just
scans.
So I wouldn't be too concerned.
> To my knowledge I don't have any software installed for which I
> needed to specify the VPS' IP, so my guess is that this will end
> when I remove the old address from network/interfaces. Is that
> right?
You will definitely not be able to send packets from an IP address
you have removed¹. ;)
> Is there a way to test before deleting the old IP?
# tcpdump -vpni eth0 'src net 212.13.194.0/23 and not arp'
will show you any traffic going in or out of your eth0 that has a
source address inside 212.13.194.0/23 and is not ARP traffic.
Cheers,
Andy
¹ OK yeah barring some crafty thing you do to generate such traffic.
_______________________________________________
users mailing list
users@lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users