Dziwny ruch siecowy ...

Muchomorr - 01-09-2008 13:00
Zastanawia mnie podejrzana ilosc pakietow otrzymywanych przez moj komputer, gdy wpisze: tcpdump -i eth1 to otrzymuje cos takiego: 12:45:58.720706 IP 10.5.105.60.39998 > dns3.vectranet.pl.domain: 38404+ PTR? 111.238.5.10.in-addr.arpa. (43)
12:45:58.727827 arp who-has 130.176.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:58.770483 IP 10.5.105.60.54856 > dns3.vectranet.pl.domain: 3372+ PTR? 123.177.156.88.in-addr.arpa. (45)
12:45:58.778786 IP dns3.vectranet.pl.domain > 10.5.105.60.54856: 3372* 1/3/4 (222)
12:45:58.779171 IP 10.5.105.60.51614 > dns3.vectranet.pl.domain: 31025+ PTR? 95.131.5.10.in-addr.arpa. (42)
12:45:58.780770 arp who-has 86.178.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:58.821076 arp who-has 10.5.121.83 tell 10.5.0.1
12:45:58.826250 IP 10.5.105.60.47787 > dns3.vectranet.pl.domain: 50606+ PTR? 167.230.5.10.in-addr.arpa. (43)
12:45:58.829789 arp who-has 208.182.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:58.871233 IP 10.5.105.60.36967 > dns3.vectranet.pl.domain: 52571+ PTR? 126.179.156.88.in-addr.arpa. (45)
12:45:58.879754 IP dns3.vectranet.pl.domain > 10.5.105.60.36967: 52571* 1/3/4 (222)
12:45:58.880016 IP 10.5.105.60.52352 > dns3.vectranet.pl.domain: 14055+ PTR? 37.182.156.88.in-addr.arpa. (44)
12:45:58.887747 IP dns3.vectranet.pl.domain > 10.5.105.60.52352: 14055* 1/3/4 (220)
12:45:58.887971 IP 10.5.105.60.34672 > dns3.vectranet.pl.domain: 48209+ PTR? 208.178.156.88.in-addr.arpa. (45)
12:45:58.894753 IP dns3.vectranet.pl.domain > 10.5.105.60.34672: 48209* 1/3/4 (222)
12:45:58.895995 IP 10.5.105.60.35004 > dns3.vectranet.pl.domain: 31391+ PTR? 38.114.5.10.in-addr.arpa. (42)
12:45:58.903794 arp who-has 152.183.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:58.905772 arp who-has 164.182.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:58.909787 arp who-has 35.183.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:58.941780 arp who-has 10.5.20.184 tell 10.5.0.1
12:45:58.951008 IP 10.5.105.60.37807 > dns3.vectranet.pl.domain: 3844+ PTR? 158.20.5.10.in-addr.arpa. (42)
12:45:58.952761 arp who-has 10.5.151.148 tell 10.5.0.1
12:45:58.953766 arp who-has 10.5.100.221 tell 10.5.0.1
12:45:59.003256 IP 10.5.105.60.45081 > dns3.vectranet.pl.domain: 35311+ PTR? 157.20.5.10.in-addr.arpa. (42)
12:45:59.027765 arp who-has 45.178.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:59.052976 IP 10.5.105.60.33873 > dns3.vectranet.pl.domain: 14105+ PTR? 8.246.5.10.in-addr.arpa. (41)
12:45:59.100754 IP dns3.vectranet.pl.domain > 10.5.105.60.33873: 14105 NXDomain* 0/1/0 (118)
12:45:59.101228 IP 10.5.105.60.58943 > dns3.vectranet.pl.domain: 26245+ PTR? 177.237.5.10.in-addr.arpa. (43)
12:45:59.101755 arp who-has 46.176.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:59.153147 IP 10.5.105.60.54763 > dns3.vectranet.pl.domain: 26934+ PTR? 190.207.5.10.in-addr.arpa. (43)
12:45:59.159709 arp who-has 10.5.52.25 tell 10.5.0.1
12:45:59.199743 IP dns3.vectranet.pl.domain > 10.5.105.60.54763: 26934 NXDomain* 0/1/0 (120)
12:45:59.200164 IP 10.5.105.60.36845 > dns3.vectranet.pl.domain: 3873+ PTR? 249.74.5.10.in-addr.arpa. (42)
12:45:59.207729 arp who-has 35.178.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:59.213730 arp who-has 126.176.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:59.246100 IP 10.5.105.60.52076 > dns3.vectranet.pl.domain: 10823+ PTR? 197.213.5.10.in-addr.arpa. (43)
12:45:59.251693 arp who-has 150.177.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:59.292151 IP 10.5.105.60.48664 > dns3.vectranet.pl.domain: 9947+ PTR? 35.48.5.10.in-addr.arpa. (41)
12:45:59.335718 arp who-has 9.181.stk.vectranet.pl tell 1.176.stk.vectranet.pl
12:45:59.339672 arp who-has 10.5.20.200 tell 10.5.0.1
12:45:59.344073 IP 10.5.105.60.60337 > dns3.vectranet.pl.domain: 63667+ PTR? 231.181.156.88.in-addr.arpa. (45)
12:45:59.351723 IP dns3.vectranet.pl.domain > 10.5.105.60.60337: 63667* 1/3/4 (222)
12:45:59.352224 IP 10.5.105.60.52784 > dns3.vectranet.pl.domain: 37484+ PTR? 177.183.156.88.in-addr.arpa. (45)
12:45:59.360711 IP dns3.vectranet.pl.domain > 10.5.105.60.52784: 37484* 1/3/4 (222)
12:45:59.361255 IP 10.5.105.60.42497 > dns3.vectranet.pl.domain: 32466+ PTR? 134.114.5.10.in-addr.arpa. (43)
12:45:59.566674 arp who-has 10.5.230.109 tell 10.5.0.1

795 packets captured
1458 packets received by filter
581 packets dropped by kernel Nic nie mam odpalonego a to sobie leci i leci...
Statystyki polaczenia w Gnome leca w kosmos, jesli chodzi o ilosc otrzymanych pakietow: tcpdump -i eth1 -n arp 12:53:37.306054 arp who-has 88.156.183.110 tell 88.156.176.1
12:53:37.307058 arp who-has 88.156.183.111 tell 88.156.176.1
12:53:37.313070 arp who-has 10.5.254.213 tell 10.5.0.1
12:53:37.353055 arp who-has 88.156.183.113 tell 88.156.176.1
12:53:37.356050 arp who-has 88.156.179.158 tell 88.156.176.1
12:53:37.360069 arp who-has 88.156.180.199 tell 88.156.176.1
12:53:37.375066 arp who-has 88.156.183.115 tell 88.156.176.1
12:53:37.376050 arp who-has 88.156.183.13 tell 88.156.176.1
12:53:37.400051 arp who-has 88.156.183.116 tell 88.156.176.1
12:53:37.407043 arp who-has 88.156.183.189 tell 88.156.176.1
12:53:37.408013 arp who-has 88.156.183.27 tell 88.156.176.1
12:53:37.410037 arp who-has 88.156.183.117 tell 88.156.176.1
12:53:37.413042 arp who-has 88.156.183.53 tell 88.156.176.1
12:53:37.420045 arp who-has 88.156.178.143 tell 88.156.176.1
12:53:37.435056 arp who-has 10.5.146.120 tell 10.5.0.1
12:53:37.462049 arp who-has 10.5.50.172 tell 10.5.0.1
12:53:37.463005 arp who-has 10.5.193.221 tell 10.5.0.1
12:53:37.465013 arp who-has 88.156.176.139 tell 88.156.176.1
12:53:37.466010 arp who-has 88.156.183.118 tell 88.156.176.1
12:53:37.477040 arp who-has 88.156.180.214 tell 88.156.176.1
12:53:37.478002 arp who-has 10.5.234.194 tell 10.5.0.1
12:53:37.486040 arp who-has 88.156.183.84 tell 88.156.176.1
12:53:37.488036 arp who-has 10.5.207.152 tell 10.5.0.1
12:53:37.490028 arp who-has 88.156.177.227 tell 88.156.176.1
12:53:37.493028 arp who-has 10.5.50.242 tell 10.5.0.1
12:53:37.514036 arp who-has 88.156.177.144 tell 88.156.176.1
12:53:37.543031 arp who-has 88.156.177.221 tell 88.156.176.1
12:53:37.550022 arp who-has 10.5.252.70 tell 10.5.0.1
12:53:37.563018 arp who-has 88.156.180.219 tell 88.156.176.1
12:53:37.566015 arp who-has 10.5.83.193 tell 10.5.0.1
12:53:37.567006 arp who-has 10.5.58.142 tell 10.5.0.1
12:53:37.572037 arp who-has 88.156.181.70 tell 88.156.176.1
12:53:37.580034 arp who-has 10.5.108.243 tell 10.5.0.1
12:53:37.583021 arp who-has 10.5.69.16 tell 10.5.0.1
12:53:37.584016 arp who-has 10.5.131.240 tell 10.5.0.1
12:53:37.595020 arp who-has 10.5.241.40 tell 10.5.0.1
12:53:37.600016 arp who-has 88.156.183.119 tell 88.156.176.1
12:53:37.600981 arp who-has 10.5.144.207 tell 10.5.0.1
12:53:37.604002 arp who-has 88.156.183.120 tell 88.156.176.1
12:53:37.604982 arp who-has 88.156.183.159 tell 88.156.176.1
12:53:37.610014 arp who-has 88.156.180.246 tell 88.156.176.1
12:53:37.618015 arp who-has 88.156.180.248 tell 88.156.176.1
12:53:37.623009 arp who-has 88.156.183.121 tell 88.156.176.1
12:53:37.641020 arp who-has 10.5.216.20 tell 10.5.0.1
12:53:37.647009 arp who-has 10.5.37.228 tell 10.5.0.1
12:53:37.656021 arp who-has 10.5.132.252 tell 10.5.0.1
857 packets captured
857 packets received by filter
0 packets dropped by kernel Jakims wielkim fachowcem nie jestem ale czy moja sieciowka musi to wszytsko "lykac"?
Da sie to jakos ograniczyc? Firwalla nie mam w obecnej chwili, bo po zainstalowania Firestartera wywala sie podczas bootowania systemu, a odpalony w Gnome, wywala sie i znika z traya, po roznym czasie czasem po kilku minutach czasem po kilku godzinach.

Jakies sugestie?

Pozdrawiam.
Przyklad:
Uptime: 2h 32m
687636 packets (41.4 Mb)

SeRdEcZnY - 01-09-2008 19:24
Zauważyłem, że używając torrenta (na Windowsie), przełączając komputer na Linuksa mam od groma pakietów przychodzących (widzę na Firestarterze).

Pozdrawiam ;)

sappa - 01-09-2008 23:48
Co do arpow to mam to samo, w vectrze tak jest. Tak to jest sa sa sieci po 1000 hostów, a co do reszty to widze tam tylko dns'y tyle ze cos na twoim komputerze rozwiazuje jakies dziwne adresy, bo wszystkie koncza sie na 10 albo 88 (conajmniej dziwne). Nie masz za tym komputerem jakiegos Windowsa, ewentualnie zainstalowanego na nim jakiegos mula czy innego p2p?

Muchomorr - 02-09-2008 00:50
No wlasnie to mnie dziwi, tzn mnostwo ruchu z mojego lokalnego IP do dns. Zadnych p2p nie bylo odpalonych :)
Vectra ma faktycznie mnostwo hostow,

88.156.*.* widocznie taka pule adresow ma Vectra dla swoich klientow ktorzy wykupili zewn IP

Czyli wniosek ze wszystko jest w jak najlepszym porzadku?
nmap localhost

Starting Nmap 4.62 ( http://nmap.org ) at 2008-09-02 00:13 CEST
Warning: Hostname localhost resolves to 2 IPs. Using 127.0.0.1.
Interesting ports on localhost (127.0.0.1):
Not shown: 1714 closed ports
PORT STATE SERVICE
631/tcp open ipp
Nmap done: 1 IP address (1 host up) scanned in 0.221 seconds Na 10.5.*.* mam wszystkie porty pozamykane ten otwarty na localhost jest nieszkodliwy ale dlaczego mam 2 IPs?

zanotowane.pl

doc.pisz.pl

pdf.pisz.pl

minister.pev.pl