Hi!
I use "firestarter" to configure my firewall. I am not expert in linux-networking, so my question might be a bit "low-leveled". If I take a look at my hitlist, there are some portscans and stuff, but I dont understand this entry:
Time: Aug 10 15:14:00 Source: 192.168.0.2 Destination: 200.55.90.253 In IF: Out IF: eth0 Port: 1234 Length: 44 ToS: 0x00 Protocol: tcp Service: subseven
Isn't subseven an trojan-tool?
And the most disturbing thing is, that the source (i.e. "192.168.0.2") is my local ip-address in our home-network.
How is this possible and is my machine really sending portscans or what else does this hit tell me?
Greetings, -- Thomas B. ICQ UIN#: 28869987
Here there be tygers.
Am Di, den 10.08.2004 schrieb Thomas Bitschnau um 15:34:
I use "firestarter" to configure my firewall. I am not expert in linux-networking, so my question might be a bit "low-leveled". If I take a look at my hitlist, there are some portscans and stuff, but I dont understand this entry:
Time: Aug 10 15:14:00 Source: 192.168.0.2 Destination: 200.55.90.253 In IF: Out IF: eth0 Port: 1234 Length: 44 ToS: 0x00 Protocol: tcp Service: subseven
http://logi.cc/linux/netfilter-log-format.php3
explains the entries of unmodified netfilter log entries. It seems firestarter changes the logging a bit.
Isn't subseven an trojan-tool?
Yes, it is. The above line tells you: the host with IP 192.168.0.2 did connect the host with IP 200.55.90.253 on port 1234, going through interface eth0. I guess you did not copy&paste but mistyped the log line a bit. The port should be 1243 and it is a well known port for the SubSeven trojan. I guess firestarter has a list of these ports (it is not stored in /etc/services). See
http://www.glocksoft.com/trojan_list/SubSeven.htm
And the most disturbing thing is, that the source (i.e. "192.168.0.2") is my local ip-address in our home-network.
I hope you have an anti-virus scanner on the host with IP 192.168.0.2 (guessing it is a Windows[tm] machine).
How is this possible and is my machine really sending portscans or what else does this hit tell me?
Connecting a port on a foreign host does not necessarily mean portscanning. Check the host under your control. If you don't have permissions then block those connections you don't want to allow.
Btw. the named port on the foreign host is open and shows
1234/tcp open hotline?
You may have a software on host 192.168.0.2 which is "telephoning home".
Thomas B.
Alexander
On Tue, 2004-08-10 at 16:00, Alexander Dalloz wrote:
Connecting a port on a foreign host does not necessarily mean portscanning. Check the host under your control. If you don't have permissions then block those connections you don't want to allow.
Btw. the named port on the foreign host is open and shows
1234/tcp open hotline?
You may have a software on host 192.168.0.2 which is "telephoning home".
Thats the big problem.
The host with this ip-address is the host I am writing this email at the moment and it's a Fedora Core 2 machine.
I doubt there is a subseven-version for linux?
Where can I find "the real" entry, not the "firestarter" one?
Greetings, -- Thomas B. ICQ UIN#: 28869987
"But I don't like Spam!!!!"
On Tue, Aug 10, 2004 at 04:22:56PM +0200, Thomas Bitschnau wrote:
On Tue, 2004-08-10 at 16:00, Alexander Dalloz wrote:
Connecting a port on a foreign host does not necessarily mean portscanning. Check the host under your control. If you don't have permissions then block those connections you don't want to allow.
Btw. the named port on the foreign host is open and shows
1234/tcp open hotline?
You may have a software on host 192.168.0.2 which is "telephoning home".
Thats the big problem.
The host with this ip-address is the host I am writing this email at the moment and it's a Fedora Core 2 machine.
I doubt there is a subseven-version for linux?
Where can I find "the real" entry, not the "firestarter" one?
Thomas - I suggest you join the Firestarter list. Go to the Firestarter page at:
http://firestarter.sourceforge.net
and click on the Mailing List link at the top right. The main author is quick to help and can provide some detail on the FS log parsing methods.