Finding out old IP users

List overview All Threads
Download

newer

older

RAM requirements for CentOS 6.x /...

Lenny-to-Squeeze Upgrade Plan -...

Taavi Ilves

22 Jan 2012 22 Jan '12

11:47 a.m.

Hi I'm pretty sure that my host has been fully configured for new IP, but I got notification that someone has used old IP recently. Has anyone a simple solution for catching where from and which protocol are those connections coming for old IP? Thanks, Taavi

Show replies by thread

Andy Smith

22 Jan 22 Jan

11:54 a.m.

Hi Taavi, On Sun, Jan 22, 2012 at 01:47:58PM +0200, Taavi Ilves wrote:

...

Has anyone a simple solution for catching where from and which protocol are those connections coming for old IP?

# tcpdump -vpni eth0 'host 212.13.19X.Y' I've had a quick look and it seems to mostly just be random useless traffic. You could avoid being warned again by removing the IP address entirely: # ip addr del 212.13.19X.Y dev eth0 (then remove from network configuration so it doesn't come back next time you boot) Cheers, Andy -- http://bitfolk.com/ -- No-nonsense VPS hosting

Taavi Ilves

12:10 p.m.

Hi Andy, Thanks for quick answer. I thought so. Removed old IP (from both running machine and configuration). All the best, Taavi On Sun, Jan 22, 2012 at 1:54 PM, Andy Smith <andy(a)bitfolk.com> wrote:

...

Hi Taavi, On Sun, Jan 22, 2012 at 01:47:58PM +0200, Taavi Ilves wrote:

Has anyone a simple solution for catching where from and which protocol are those connections coming for old IP?

S P

26 Jan 26 Jan

3:30 a.m.

Andy, I got your point about "ip addr del ...", but could you help out with "... then remove from network configuration ..."? Thanks, Sandy On Sun, Jan 22, 2012 at 6:54 AM, Andy Smith <andy(a)bitfolk.com> wrote:

...

Hi Taavi, On Sun, Jan 22, 2012 at 01:47:58PM +0200, Taavi Ilves wrote:

Has anyone a simple solution for catching where from and which protocol are those connections coming for old IP?

Gavin Westwood

7:35 a.m.

On 26/01/2012 03:30, S P wrote:

...

I got your point about "ip addr del ...", but could you help out with "... then remove from network configuration ..."? <snip>

Hello Sandy. If you are running a Debian-based distro, then you should be able to find you IP address configuration in /etc/network/interfaces and be able to change it there. Thanks Gavin

Andy Smith

10:37 a.m.

Hi Sandy, On Thu, Jan 26, 2012 at 07:35:37AM +0000, Gavin Westwood wrote:

...

On 26/01/2012 03:30, S P wrote: > I got your point about "ip addr del ...", but could you help out with > "... then remove from network configuration ..."? > <snip>

I mean that you should adjust the configuration files that the system uses on boot to set up its networking so that the old IP addresses don't come back.

...

If you are running a Debian-based distro, then you should be able to find you IP address configuration in /etc/network/interfaces and be able to change it there.

…and if you are running a RHEL-based one then it would be in /etc/sysconfig/network and /etc/sysconfig/network-scripts/ifcfg-eth0 Cheers, Andy -- http://bitfolk.com/ -- No-nonsense VPS hosting

S P

27 Jan 27 Jan

12:40 a.m.

Thanks Gavin and Andy. Problem all cleared up. - Sandy On Thu, Jan 26, 2012 at 5:37 AM, Andy Smith <andy(a)bitfolk.com> wrote:

...

Hi Sandy, On Thu, Jan 26, 2012 at 07:35:37AM +0000, Gavin Westwood wrote:

On 26/01/2012 03:30, S P wrote: > I got your point about "ip addr del ...", but could you help out with > "... then remove from network configuration ..."? > <snip>

I mean that you should adjust the configuration files that the system uses on boot to set up its networking so that the old IP addresses don't come back.

If you are running a Debian-based distro, then you should be able to find you IP address configuration in /etc/network/interfaces and be able to change it there.

…and if you are running a RHEL-based one then it would be in /etc/sysconfig/network and /etc/sysconfig/network-scripts/ifcfg-eth0 Cheers, Andy -- http://bitfolk.com/ -- No-nonsense VPS hosting _______________________________________________ users mailing list users(a)lists.bitfolk.com https://lists.bitfolk.com/mailman/listinfo/users

S P

4:09 a.m.

Andy, I still have a related problem. After removing the old IP (212....) and rebooting. -- VPN into the new IP (85...) -- ifconfig still shows the old IP in ppp0 ! I have verified from 2 different client computers, but ppp0 always shows the old IP. I have verified that no firewall nat rules reference the old IP. I have rebooted the VPS a couple of times. Any ideas? Thanks, Sandy # ifconfig eth0 Link encap:Ethernet HWaddr ... inet addr:*85.119.82.244* Bcast:85.119.87.255 Mask:255.255.248.0 inet6 addr: 2001:ba8:1f1:f1be::2/64 Scope:Global inet6 addr: fe80::216:5eff:fe00:236/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 ppp0 Link encap:Point-to-Point Protocol inet addr:*212.13.194.244* P-t-P:10.1.0.1 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1496 Metric:1 On Thu, Jan 26, 2012 at 5:37 AM, Andy Smith <andy(a)bitfolk.com> wrote:

...

Hi Sandy, On Thu, Jan 26, 2012 at 07:35:37AM +0000, Gavin Westwood wrote:

On 26/01/2012 03:30, S P wrote: > I got your point about "ip addr del ...", but could you help out with > "... then remove from network configuration ..."? > <snip>

I mean that you should adjust the configuration files that the system uses on boot to set up its networking so that the old IP addresses don't come back.

If you are running a Debian-based distro, then you should be able to find you IP address configuration in /etc/network/interfaces and be able to change it there.

Andy Smith

5:28 a.m.

Hi Sandy, On Thu, Jan 26, 2012 at 11:09:38PM -0500, S P wrote:

...

I still have a related problem. After removing the old IP (212....) and rebooting. -- VPN into the new IP (85...) -- ifconfig still shows the old IP in ppp0 !

ppp0 must have been something you configured, so however you did that, that would be the place to look. What VPN software are you using? Cheers, Andy -- http://bitfolk.com/ -- No-nonsense VPS hosting

4484

days inactive

4489

days old

users@mailman.bitfolk.com

Manage subscription

8 comments

4 participants

tags (0)

participants (4)

Andy Smith
Gavin Westwood
S P
Taavi Ilves