= Сообщение: 1575 из 10763 ===================================== RU.UNIX.BSD =
От : Dmitry Dolzenko 2:5020/400 05 Jun 14 15:33:30
Кому : All 05 Jun 14 15:33:30
Тема : Шторм запросов ARP
FGHI : area://RU.UNIX.BSD?msgid=<1187488840@ddt.demos.su>+3565f259
= Кодировка сообщения определена как: CP866 ==================================
==============================================================================
From: "Dmitry Dolzenko" <dol@mig.phys.msu.ru>
Приветствую!
Сервак стоит у провайдера.
Hа сетевом интерфейсе вижу tcpdump кучу ARP запросов
Что это? Кривая конфигурация провайдерских роутеров или атака?
Сетка самого хоста 178.238.233.x
13:10:12.988978 ARP, Request who-has 93.104.212.81 tell 93.104.212.1, length
46
13:10:13.002918 ARP, Request who-has 178.238.224.161 tell 178.238.224.1,
length 46
13:10:13.003289 ARP, Request who-has 178.238.229.224 tell 178.238.229.1,
length 46
13:10:13.005595 ARP, Request who-has 80.241.211.118 tell 80.241.211.1,
length 46
13:10:13.015053 ARP, Request who-has 79.143.176.86 tell 79.143.176.1, length
46
13:10:13.018782 ARP, Request who-has 179.63.136.194 tell 179.63.128.1,
length 46
13:10:13.028285 ARP, Request who-has 178.238.228.243 tell 178.238.228.1,
length 46
13:10:13.030000 ARP, Request who-has 80.241.218.89 tell 80.241.218.1, length
46
13:10:13.031810 ARP, Request who-has 80.241.218.130 tell 80.241.218.1,
length 46
13:10:13.041434 ARP, Request who-has 79.143.178.196 tell 79.143.178.1,
length 46
13:10:13.082374 ARP, Request who-has 179.63.138.55 tell 179.63.128.1, length
46
13:10:13.117089 ARP, Request who-has 178.238.235.3 tell 178.238.235.1,
length 46
13:10:13.117138 ARP, Request who-has 93.104.210.102 tell 93.104.210.1,
length 46
13:10:13.117192 ARP, Request who-has 80.241.222.94 tell 80.241.222.1, length
46
13:10:13.117216 ARP, Request who-has 193.164.131.142 tell 193.164.131.129,
length 46
13:10:13.172995 ARP, Request who-has 178.238.225.221 tell 178.238.225.1,
length 46
13:10:13.173031 ARP, Request who-has 178.238.228.63 tell 178.238.228.1,
length 46
13:10:13.173062 ARP, Request who-has 79.143.184.28 tell 79.143.184.1, length
46
13:10:13.173083 ARP, Request who-has 178.238.234.142 tell 178.238.234.1,
length 46
13:10:13.173137 ARP, Request who-has 79.143.177.64 tell 79.143.177.1, length
46
13:10:13.173164 ARP, Request who-has 178.238.225.30 tell 178.238.225.1,
length 46
13:10:13.173188 ARP, Request who-has 80.241.212.226 tell 80.241.212.1,
length 46
13:10:13.173209 ARP, Request who-has 178.238.228.171 tell 178.238.228.1,
length 46
13:10:13.173234 ARP, Request who-has 178.238.226.241 tell 178.238.226.1,
length 46
13:10:13.173258 ARP, Request who-has 178.238.239.218 tell 178.238.239.193,
length 46
13:10:13.173282 ARP, Request who-has 178.238.232.32 tell 178.238.232.1,
length 46
13:10:13.228459 ARP, Request who-has 185.2.102.65 tell 185.2.102.1, length
46
13:10:13.228480 ARP, Request who-has 80.241.210.89 tell 80.241.210.1, length
46
13:10:13.228506 ARP, Request who-has 80.241.218.19 tell 80.241.218.1, length
46
13:10:13.228531 ARP, Request who-has 178.238.235.153 tell 178.238.235.1,
length 46
13:10:13.228559 ARP, Request who-has 185.2.103.80 tell 185.2.103.1, length
46
13:10:13.228583 ARP, Request who-has 185.2.100.25 tell 185.2.100.1, length
46
13:10:13.228616 ARP, Request who-has 192.253.252.93 tell 192.253.252.1,
length 46
13:10:13.286400 ARP, Request who-has 179.63.133.194 tell 179.63.128.1,
length 46
13:10:13.286410 ARP, Request who-has 178.238.228.167 tell 178.238.228.1,
length 46
13:10:13.286412 ARP, Request who-has 79.143.189.89 tell 79.143.189.1, length
46
13:10:13.286422 ARP, Request who-has 178.238.237.101 tell 178.238.237.1,
length 46
13:10:13.334383 ARP, Request who-has 178.238.236.44 tell 178.238.236.1,
length 46
13:10:13.334453 ARP, Request who-has 179.63.136.101 tell 179.63.128.1,
length 46
13:10:13.334481 ARP, Request who-has 79.143.181.142 tell 79.143.181.1,
length 46
13:10:13.334505 ARP, Request who-has 178.238.225.19 tell 178.238.225.1,
length 46
13:10:13.337273 ARP, Request who-has 79.143.180.32 tell 79.143.180.1, length
46
13:10:13.339987 ARP, Request who-has 213.136.65.246 tell 213.136.65.1,
length 46
13:10:13.342874 ARP, Request who-has 192.253.252.83 tell 192.253.252.1,
length 46
13:10:13.345633 ARP, Request who-has 178.238.225.183 tell 178.238.225.1,
length 46
--- ifmail v.2.15dev5.4
* Origin: Demos online service (2:5020/400)
|
