Не уверен что из-за процесса зомби рвётся Инет (т.к. сейчас пришел и наблюдаю)
Картинка:
Лог:
Код:
System Log
Date/Time Facility Severity Message
Sep 5 07:00:27 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.65.38 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=56430 DF PROTO=TCP SPT=37777 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 07:08:33 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=90.151.196.201 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=252 ID=5733 DF PROTO=TCP SPT=1756 DPT=20187 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 07:16:05 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.42.252 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=251 ID=52858 DF PROTO=TCP SPT=4024 DPT=445 WINDOW=65280 RES=0x00 SYN URGP=0
Sep 5 07:23:31 syslog info -- MARK --
Sep 5 07:29:38 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.65.38 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=20220 DF PROTO=TCP SPT=46990 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 07:35:49 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.226.56 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=252 ID=31440 DF PROTO=TCP SPT=15911 DPT=2967 WINDOW=64800 RES=0x00 SYN URGP=0
Sep 5 07:45:32 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.11.240.242 DST=92.125.109.156 LEN=64 TOS=0x00 PREC=0x00 TTL=252 ID=25836 DF PROTO=TCP SPT=3100 DPT=135 WINDOW=53760 RES=0x00 SYN URGP=0
Sep 5 07:56:39 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.11.240.242 DST=92.125.109.156 LEN=64 TOS=0x00 PREC=0x00 TTL=252 ID=16228 DF PROTO=TCP SPT=3211 DPT=135 WINDOW=53760 RES=0x00 SYN URGP=0
Sep 5 08:08:32 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=90.151.196.201 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=252 ID=59867 DF PROTO=TCP SPT=1101 DPT=20187 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 08:16:06 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.49.24 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=251 ID=6452 DF PROTO=TCP SPT=21468 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Sep 5 08:23:31 syslog info -- MARK --
Sep 5 08:25:51 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.49.24 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=251 ID=31670 DF PROTO=TCP SPT=1064 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Sep 5 08:37:48 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.65.38 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=30473 DF PROTO=TCP SPT=6041 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 08:48:06 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.65.38 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=42239 DF PROTO=TCP SPT=9091 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 08:57:12 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.65.38 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=50862 DF PROTO=TCP SPT=12160 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 09:05:56 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.48.20.173 DST=92.125.109.156 LEN=64 TOS=0x00 PREC=0x00 TTL=252 ID=25104 DF PROTO=TCP SPT=2797 DPT=135 WINDOW=53760 RES=0x00 SYN URGP=0
Sep 5 09:18:02 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.65.38 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=15223 DF PROTO=TCP SPT=18316 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 09:23:32 syslog info -- MARK --
Sep 5 09:26:20 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.123.224 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=55160 DF PROTO=TCP SPT=4826 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Sep 5 09:36:52 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.107.105 DST=92.125.109.156 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=1135 DF PROTO=TCP SPT=3618 DPT=135 WINDOW=60352 RES=0x00 SYN URGP=115
Sep 5 09:47:32 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.65.38 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=53087 DF PROTO=TCP SPT=27522 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 09:58:54 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.68.36 DST=92.125.109.156 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=36880 DF PROTO=TCP SPT=27571 DPT=135 WINDOW=60352 RES=0x00 SYN URGP=0
Sep 5 10:08:25 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.65.38 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=17674 DF PROTO=TCP SPT=33688 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 10:18:13 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.67.61 DST=92.125.109.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=13020 DF PROTO=TCP SPT=3588 DPT=135 WINDOW=64800 RES=0x00 SYN URGP=0
Sep 5 10:23:31 syslog info -- MARK --
Sep 5 10:23:43 daemon info pppd[241]: LCP terminated by peer
Sep 5 10:23:44 daemon info pppd[241]: Connect time 1440.0 minutes.
Sep 5 10:23:44 daemon info pppd[241]: Sent 67638442 bytes, received 278074066 bytes.
Sep 5 10:23:44 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:23:47 daemon notice pppd[241]: Connection terminated....
Sep 5 10:23:53 daemon info pppd[241]: Sent PADT
Sep 5 10:23:53 daemon info pppd[241]: PPP session is 3377
Sep 5 10:23:54 daemon info pppd[241]: Using interface ppp0_0_35_1
Sep 5 10:23:54 daemon notice pppd[241]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Sep 5 10:23:54 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:23:54 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:23:54 daemon notice pppd[241]: PAP authentication succeeded
Sep 5 10:23:54 daemon notice pppd[241]: peer from calling number 00:90:1A:42:B8:EF authorized
Sep 5 10:23:56 daemon notice pppd[241]: local IP address 92.125.108.108
Sep 5 10:23:56 daemon notice pppd[241]: remote IP address 213.228.116.68
Sep 5 10:23:56 daemon notice pppd[241]: primary DNS address 212.94.96.124
Sep 5 10:23:56 daemon notice pppd[241]: secondary DNS address 212.94.96.70
Sep 5 10:24:10 user warn syslog: dns query failed
Sep 5 10:24:12 user warn syslog: dns query failed
Sep 5 10:24:14 user warn syslog: dns query failed
Sep 5 10:24:16 user warn syslog: dns query failed
Sep 5 10:24:18 user warn syslog: dns query failed
Sep 5 10:24:20 user warn syslog: dns query failed
Sep 5 10:24:53 user warn syslog: dns query failed
Sep 5 10:24:55 user warn syslog: dns query failed
Sep 5 10:24:57 user warn syslog: dns query failed
Sep 5 10:24:59 user warn syslog: dns query failed
Sep 5 10:25:01 user warn syslog: dns query failed
Sep 5 10:25:03 user warn syslog: dns query failed
Sep 5 10:25:33 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.74.164 DST=92.125.108.108 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=57862 DF PROTO=TCP SPT=4711 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Sep 5 10:25:39 user warn syslog: dns query failed
Sep 5 10:25:41 user warn syslog: dns query failed
Sep 5 10:25:43 user warn syslog: dns query failed
Sep 5 10:25:45 user warn syslog: dns query failed
Sep 5 10:25:47 user warn syslog: dns query failed
Sep 5 10:25:49 user warn syslog: dns query failed
Sep 5 10:26:27 user warn syslog: dns query failed
Sep 5 10:26:29 user warn syslog: dns query failed
Sep 5 10:26:31 user warn syslog: dns query failed
Sep 5 10:26:33 user warn syslog: dns query failed
Sep 5 10:26:35 user warn syslog: dns query failed
Sep 5 10:26:37 user warn syslog: dns query failed
Sep 5 10:27:11 user warn syslog: dns query failed
Sep 5 10:27:13 user warn syslog: dns query failed
Sep 5 10:27:15 user warn syslog: dns query failed
Sep 5 10:27:17 user warn syslog: dns query failed
Sep 5 10:27:19 user warn syslog: dns query failed
Sep 5 10:27:21 user warn syslog: dns query failed
Sep 5 10:28:03 user warn syslog: dns query failed
Sep 5 10:28:05 user warn syslog: dns query failed
Sep 5 10:28:07 user warn syslog: dns query failed
Sep 5 10:28:09 user warn syslog: dns query failed
Sep 5 10:28:11 user warn syslog: dns query failed
Sep 5 10:28:13 user warn syslog: dns query failed
Sep 5 10:28:51 user warn syslog: dns query failed
Sep 5 10:28:53 user warn syslog: dns query failed
Sep 5 10:28:55 user warn syslog: dns query failed
Sep 5 10:28:57 user warn syslog: dns query failed
Sep 5 10:28:59 user warn syslog: dns query failed
Sep 5 10:29:01 user warn syslog: dns query failed
Sep 5 10:29:38 user warn syslog: dns query failed
Sep 5 10:29:40 user warn syslog: dns query failed
Sep 5 10:29:42 user warn syslog: dns query failed
Sep 5 10:29:44 user warn syslog: dns query failed
Sep 5 10:29:46 user warn syslog: dns query failed
Sep 5 10:29:48 user warn syslog: dns query failed
Sep 5 10:30:27 user warn syslog: dns query failed
Sep 5 10:30:29 user warn syslog: dns query failed
Sep 5 10:30:31 user warn syslog: dns query failed
Sep 5 10:30:33 user warn syslog: dns query failed
Sep 5 10:30:35 user warn syslog: dns query failed
Sep 5 10:30:37 user warn syslog: dns query failed
Sep 5 10:31:10 user warn syslog: dns query failed
Sep 5 10:31:12 user warn syslog: dns query failed
Sep 5 10:31:14 user warn syslog: dns query failed
Sep 5 10:31:16 user warn syslog: dns query failed
Sep 5 10:31:18 user warn syslog: dns query failed
Sep 5 10:31:20 user warn syslog: dns query failed
Sep 5 10:31:53 user warn syslog: dns query failed
Sep 5 10:31:55 user warn syslog: dns query failed
Sep 5 10:31:57 user warn syslog: dns query failed
Sep 5 10:31:59 user warn syslog: dns query failed
Sep 5 10:32:01 user warn syslog: dns query failed
Sep 5 10:32:03 user warn syslog: dns query failed
Sep 5 10:32:39 user warn syslog: dns query failed
Sep 5 10:32:41 user warn syslog: dns query failed
Sep 5 10:32:43 user warn syslog: dns query failed
Sep 5 10:32:45 user warn syslog: dns query failed
Sep 5 10:32:47 user warn syslog: dns query failed
Sep 5 10:32:49 user warn syslog: dns query failed
Sep 5 10:33:22 user warn syslog: dns query failed
Sep 5 10:33:24 user warn syslog: dns query failed
Sep 5 10:33:26 user warn syslog: dns query failed
Sep 5 10:33:28 user warn syslog: dns query failed
Sep 5 10:33:30 user warn syslog: dns query failed
Sep 5 10:33:32 user warn syslog: dns query failed
Sep 5 10:34:04 user warn syslog: dns query failed
Sep 5 10:34:06 user warn syslog: dns query failed
Sep 5 10:34:08 user warn syslog: dns query failed
Sep 5 10:34:10 user warn syslog: dns query failed
Sep 5 10:34:12 user warn syslog: dns query failed
Sep 5 10:34:14 user warn syslog: dns query failed
Sep 5 10:34:52 user warn syslog: dns query failed
Sep 5 10:34:54 user warn syslog: dns query failed
Sep 5 10:34:56 user warn syslog: dns query failed
Sep 5 10:34:58 user warn syslog: dns query failed
Sep 5 10:35:00 user warn syslog: dns query failed
Sep 5 10:35:02 user warn syslog: dns query failed
Sep 5 10:35:36 user warn syslog: dns query failed
Sep 5 10:35:38 user warn syslog: dns query failed
Sep 5 10:35:40 user warn syslog: dns query failed
Sep 5 10:35:42 user warn syslog: dns query failed
Sep 5 10:35:44 user warn syslog: dns query failed
Sep 5 10:35:46 user warn syslog: dns query failed
Sep 5 10:36:23 user warn syslog: dns query failed
Sep 5 10:36:25 user warn syslog: dns query failed
Sep 5 10:36:27 user warn syslog: dns query failed
Sep 5 10:36:29 user warn syslog: dns query failed
Sep 5 10:36:31 user warn syslog: dns query failed
Sep 5 10:36:33 user warn syslog: dns query failed
Sep 5 10:37:00 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=91.144.133.16 DST=92.125.108.108 LEN=48 TOS=0x00 PREC=0x00 TTL=252 ID=24314 DF PROTO=TCP SPT=38626 DPT=58939 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 5 10:37:10 user warn syslog: dns query failed
Sep 5 10:37:12 user warn syslog: dns query failed
Sep 5 10:37:14 user warn syslog: dns query failed
Sep 5 10:37:16 user warn syslog: dns query failed
Sep 5 10:37:18 user warn syslog: dns query failed
Sep 5 10:37:20 user warn syslog: dns query failed
Sep 5 10:37:53 user warn syslog: dns query failed
Sep 5 10:37:55 user warn syslog: dns query failed
Sep 5 10:37:57 user warn syslog: dns query failed
Sep 5 10:37:59 user warn syslog: dns query failed
Sep 5 10:38:01 user warn syslog: dns query failed
Sep 5 10:38:03 user warn syslog: dns query failed
Sep 5 10:38:38 user warn syslog: dns query failed
Sep 5 10:38:40 user warn syslog: dns query failed
Sep 5 10:38:42 user warn syslog: dns query failed
Sep 5 10:38:44 user warn syslog: dns query failed
Sep 5 10:38:46 user warn syslog: dns query failed
Sep 5 10:38:48 user warn syslog: dns query failed
Sep 5 10:39:27 user warn syslog: dns query failed
Sep 5 10:39:29 user warn syslog: dns query failed
Sep 5 10:39:31 user warn syslog: dns query failed
Sep 5 10:39:33 user warn syslog: dns query failed
Sep 5 10:39:35 user warn syslog: dns query failed
Sep 5 10:39:37 user warn syslog: dns query failed
Sep 5 10:40:09 user warn syslog: dns query failed
Sep 5 10:40:11 user warn syslog: dns query failed
Sep 5 10:40:13 user warn syslog: dns query failed
Sep 5 10:40:15 user warn syslog: dns query failed
Sep 5 10:40:17 user warn syslog: dns query failed
Sep 5 10:40:19 user warn syslog: dns query failed
Sep 5 10:40:54 user warn syslog: dns query failed
Sep 5 10:40:56 user warn syslog: dns query failed
Sep 5 10:40:58 user warn syslog: dns query failed
Sep 5 10:41:00 user warn syslog: dns query failed
Sep 5 10:41:02 user warn syslog: dns query failed
Sep 5 10:41:04 user warn syslog: dns query failed
Sep 5 10:41:50 user warn syslog: dns query failed
Sep 5 10:41:52 user warn syslog: dns query failed
Sep 5 10:41:54 user warn syslog: dns query failed
Sep 5 10:41:56 user warn syslog: dns query failed
Sep 5 10:41:58 user warn syslog: dns query failed
Sep 5 10:42:00 user warn syslog: dns query failed
Инета нет.
Перезагружаю, лог:
Код:
System Log
Date/Time Facility Severity Message
Jan 1 00:00:17 user warn kernel: Total Flash size: 2048K with 32 sectors
Jan 1 00:00:17 user warn kernel: File system address: 0xbfc10100
Jan 1 00:00:17 user warn kernel: Can't analyze prologue code at 80188344
Jan 1 00:00:17 user info kernel: Initializing Cryptographic API
Jan 1 00:00:17 user info kernel: PPP generic driver version 2.4.2
Jan 1 00:00:17 user info kernel: PPP Deflate Compression module registered
Jan 1 00:00:17 user info kernel: PPP BSD Compression module registered
Jan 1 00:00:17 user info kernel: MPPE/MPPC encryption/compression module registered
Jan 1 00:00:17 user info kernel: NET: Registered protocol family 24
Jan 1 00:00:17 user warn kernel: Using noop io scheduler
Jan 1 00:00:17 user warn kernel: bcm963xx_mtd driver v1.0
Jan 1 00:00:17 user warn kernel: brcmboard: brcm_board_init entry
Jan 1 00:00:17 user warn kernel:
Jan 1 00:00:17 user warn kernel: ======= GPIO CONFIG_BCM96338 inited ========
Jan 1 00:00:17 user info kernel: Serial: BCM63XX driver $Revision: 3.00 $
Jan 1 00:00:17 user warn kernel: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX
Jan 1 00:00:17 user info kernel: NET: Registered protocol family 2
Jan 1 00:00:17 user info kernel: IP: routing cache hash table of 512 buckets, 4Kbytes
Jan 1 00:00:17 user info kernel: TCP: Hash tables configured (established 512 bind 1024)
Jan 1 00:00:17 user warn kernel: ip_conntrack version 2.1 (61 buckets, 0 max) - 376 bytes per conntrack
Jan 1 00:00:17 user warn kernel: ip_tables: (C) 2000-2002 Netfilter core team
Jan 1 00:00:17 user info kernel: Initializing IPsec netlink socket
Jan 1 00:00:17 user info kernel: NET: Registered protocol family 1
Jan 1 00:00:17 user info kernel: NET: Registered protocol family 17
Jan 1 00:00:17 user info kernel: NET: Registered protocol family 15
Jan 1 00:00:17 user notice kernel: Ebtables v2.0 registered
Jan 1 00:00:17 user info kernel: NET: Registered protocol family 8
Jan 1 00:00:17 user info kernel: NET: Registered protocol family 20
Jan 1 00:00:17 user info kernel: 802.1Q VLAN Support v1.8 Ben Greear
Jan 1 00:00:17 user info kernel: All bugs added by David S. Miller
Jan 1 00:00:17 user warn kernel: VFS: Mounted root (squashfs filesystem) readonly.
Jan 1 00:00:17 user info kernel: Freeing unused kernel memory: 76k freed
Jan 1 00:00:17 user warn kernel: Algorithmics/MIPS FPU Emulator v1.5
Jan 1 00:00:17 user warn kernel: atmapi: module license 'Proprietary' taints kernel.
Jan 1 00:00:17 user warn kernel: adsl: adsl_init entry
Jan 1 00:00:17 user warn kernel: blaadd: blaa_detect entry
Jan 1 00:00:17 user info kernel: Broadcom BCMPROCFS v1.0 initialized
Jan 1 00:00:17 user warn kernel: Broadcom BCM6338A2 Ethernet Network Device v0.3 May 28 2008 12:22:14
Jan 1 00:00:17 user warn kernel: Config Internal PHY Through MDIO
Jan 1 00:00:17 user info kernel: BCM63xx_ENET: 100 MB Full-Duplex (auto-neg)
Jan 1 00:00:17 user warn kernel: eth0: MAC Address: 00:1C:F0:8E:E9:B4
Jan 1 00:00:17 user crit kernel: eth0 Link UP.
Jan 1 00:00:17 user warn kernel: BcmAdsl_Initialize=0xC00733F8, g_pFnNotifyCallback=0xC008BC64
Jan 1 00:00:17 user warn kernel: AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00000980 adsl2=0x00000000
Jan 1 00:00:17 user warn kernel: pSdramPHY=0xA07FFFF8, 0x1B77D6 0xDEADBEEF
Jan 1 00:00:17 user warn kernel: AdslCoreHwReset: AdslOemDataAddr = 0xA07FD3D4
Jan 1 00:00:17 user warn kernel: AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00000980 adsl2=0x00000000
Jan 1 00:00:17 user warn kernel: dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
Jan 1 00:00:17 user warn kernel: ATM proc init !!!
Jan 1 00:00:17 user crit kernel: ADSL G.994 training
Jan 1 00:00:17 user warn kernel: ip_conntrack_pptp version 2.1 loaded
Jan 1 00:00:17 user warn kernel: ip_nat_pptp version 2.0 loaded
Jan 1 00:00:17 user crit kernel: ADSL G.992 started
Jan 1 00:00:17 user info kernel: device eth0 entered promiscuous mode
Jan 1 00:00:17 user info kernel: br0: port 1(eth0) entering learning state
Jan 1 00:00:17 user info kernel: br0: topology change detected, propagating
Jan 1 00:00:17 user info kernel: br0: port 1(eth0) entering forwarding state
Jan 1 00:00:17 user info kernel: device nas_0_0_35 entered promiscuous mode
Jan 1 00:00:17 user info kernel: br0: port 2(nas_0_0_35) entering learning state
Jan 1 00:00:17 user info kernel: br0: topology change detected, propagating
Jan 1 00:00:17 user info kernel: br0: port 2(nas_0_0_35) entering forwarding state
Jan 1 00:00:17 user crit kernel: ADSL G.992 channel analysis
Jan 1 00:00:17 user debug syslog: echo > /var/snmpd.conf
Jan 1 00:00:18 user debug syslog: echo > /var/hosts
Jan 1 00:00:18 user warn kernel:
Jan 1 00:00:18 user warn kernel: ioctl, p_name=diapd
Jan 1 00:00:19 user debug syslog: pppd plugin pppoe rp_pppoe_service WebStream nas_0_0_35 nodetach user '60793@256' password ********** interface_name 0_0_35_1 usepeerdns refuse-eap persist lcp-echo-interval 30 holdoff 3 lcp-echo-failure 3
Jan 1 00:00:21 daemon info pppd[241]: RP-PPPoE plugin version 3.3 compiled against pppd 2.4.3
Jan 1 00:00:21 daemon info pppd[241]: Plugin pppoe called.
Jan 1 00:00:21 user crit kernel: ADSL G.992 message exchange
Jan 1 00:00:21 user crit kernel: ADSL link up, interleaved, us=1120, ds=11552
Jan 1 00:00:21 user warn kernel: ATM Soft SAR: ATM link connected.
Jan 1 00:00:22 daemon notice pppd[241]: pppd 2.4.3 started by admin, uid 0
Jan 1 00:00:24 user debug syslog: iptables -t nat -A PREROUTING -i br0 -d 192.168.0.100 -p udp --dport 53 -j DNAT --to 128.9.0.107
Jan 1 00:00:27 daemon info pppd[241]: PPP session is 7691
Jan 1 00:00:27 daemon info pppd[241]: Using interface ppp0_0_35_1
Jan 1 00:00:27 daemon notice pppd[241]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Jan 1 00:00:27 daemon warn pppd[241]: Couldn't increase MRU to 1500
Jan 1 00:00:28 daemon warn pppd[241]: Couldn't increase MRU to 1500
Jan 1 00:00:29 daemon info pppd[241]: Remote message: Exceeded sessions limit.
Jan 1 00:00:29 daemon err pppd[241]: PAP authentication failed
Jan 1 00:00:29 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:19 daemon notice pppd[241]: Connection terminated....
Sep 5 10:44:26 daemon info pppd[241]: Sent PADT
Sep 5 10:44:27 daemon info pppd[241]: PPP session is 7738
Sep 5 10:44:27 daemon info pppd[241]: Using interface ppp0_0_35_1
Sep 5 10:44:27 daemon notice pppd[241]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Sep 5 10:44:27 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:27 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:29 daemon info pppd[241]: Remote message: Exceeded sessions limit.
Sep 5 10:44:29 daemon err pppd[241]: PAP authentication failed
Sep 5 10:44:29 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:29 daemon notice pppd[241]: Connection terminated....
Sep 5 10:44:32 daemon info pppd[241]: Sent PADT
Sep 5 10:44:32 daemon info pppd[241]: PPP session is 4428
Sep 5 10:44:32 daemon info pppd[241]: Using interface ppp0_0_35_1
Sep 5 10:44:32 daemon notice pppd[241]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Sep 5 10:44:32 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:32 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:33 daemon info pppd[241]: Remote message: Exceeded sessions limit.
Sep 5 10:44:33 daemon err pppd[241]: PAP authentication failed
Sep 5 10:44:33 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:39 daemon notice pppd[241]: Connection terminated....
Sep 5 10:44:43 daemon info pppd[241]: Sent PADT
Sep 5 10:44:43 daemon info pppd[241]: PPP session is 7783
Sep 5 10:44:43 daemon info pppd[241]: Using interface ppp0_0_35_1
Sep 5 10:44:43 daemon notice pppd[241]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Sep 5 10:44:43 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:43 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:44 daemon info pppd[241]: Remote message: Exceeded sessions limit.
Sep 5 10:44:44 daemon err pppd[241]: PAP authentication failed
Sep 5 10:44:44 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:50 daemon notice pppd[241]: Connection terminated....
Sep 5 10:44:54 daemon info pppd[241]: Sent PADT
Sep 5 10:44:54 daemon info pppd[241]: PPP session is 4550
Sep 5 10:44:54 daemon info pppd[241]: Using interface ppp0_0_35_1
Sep 5 10:44:54 daemon notice pppd[241]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Sep 5 10:44:54 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:54 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:55 daemon info pppd[241]: Remote message: Exceeded sessions limit.
Sep 5 10:44:55 daemon err pppd[241]: PAP authentication failed
Sep 5 10:44:55 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:55 daemon notice pppd[241]: Connection terminated....
Sep 5 10:44:58 daemon info pppd[241]: Sent PADT
Sep 5 10:44:58 daemon info pppd[241]: PPP session is 7849
Sep 5 10:44:58 daemon info pppd[241]: Using interface ppp0_0_35_1
Sep 5 10:44:58 daemon notice pppd[241]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Sep 5 10:44:58 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:44:59 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:45:00 daemon info pppd[241]: Remote message: Exceeded sessions limit.
Sep 5 10:45:00 daemon err pppd[241]: PAP authentication failed
Sep 5 10:45:00 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:45:00 daemon notice pppd[241]: Connection terminated....
Sep 5 10:45:03 daemon info pppd[241]: Sent PADT
Sep 5 10:45:08 daemon info pppd[241]: Sent PADT
Sep 5 10:45:08 daemon info pppd[241]: PPP session is 4607
Sep 5 10:45:08 daemon info pppd[241]: Using interface ppp0_0_35_1
Sep 5 10:45:08 daemon notice pppd[241]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Sep 5 10:45:08 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:45:09 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:45:09 daemon info pppd[241]: Remote message: Exceeded sessions limit.
Sep 5 10:45:09 daemon err pppd[241]: PAP authentication failed
Sep 5 10:45:09 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:45:09 daemon notice pppd[241]: Connection terminated....
Sep 5 10:45:12 daemon info pppd[241]: Sent PADT
Sep 5 10:45:17 daemon info pppd[241]: Sent PADT
Sep 5 10:45:27 daemon info pppd[241]: Sent PADT
Sep 5 10:45:27 daemon info pppd[241]: PPP session is 7959
Sep 5 10:45:27 daemon info pppd[241]: Using interface ppp0_0_35_1
Sep 5 10:45:27 daemon notice pppd[241]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Sep 5 10:45:27 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:45:28 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:45:29 daemon info pppd[241]: Remote message: Exceeded sessions limit.
Sep 5 10:45:29 daemon err pppd[241]: PAP authentication failed
Sep 5 10:45:29 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:45:29 daemon notice pppd[241]: Connection terminated....
Sep 5 10:45:32 daemon info pppd[241]: Sent PADT
Sep 5 10:45:32 daemon info pppd[241]: PPP session is 7972
Sep 5 10:45:32 daemon info pppd[241]: Using interface ppp0_0_35_1
Sep 5 10:45:32 daemon notice pppd[241]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Sep 5 10:45:32 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:45:32 daemon warn pppd[241]: Couldn't increase MRU to 1500
Sep 5 10:45:32 daemon notice pppd[241]: PAP authentication succeeded
Sep 5 10:45:32 daemon notice pppd[241]: peer from calling number 00:90:1A:42:B8:EF authorized
Sep 5 10:45:33 daemon notice pppd[241]: local IP address 92.125.107.222
Sep 5 10:45:33 daemon notice pppd[241]: remote IP address 213.228.116.68
Sep 5 10:45:33 daemon notice pppd[241]: primary DNS address 212.94.96.124
Sep 5 10:45:33 daemon notice pppd[241]: secondary DNS address 212.94.96.70
Sep 5 10:45:40 user debug syslog: route add default gw 213.228.116.68 2>/dev/null
Sep 5 10:45:41 user debug syslog: iptables -A FORWARD -o ppp_0_0_35_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Sep 5 10:45:41 user debug syslog: iptables -A FORWARD -i ppp_0_0_35_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Sep 5 10:45:41 user debug syslog: echo > /proc/net/ip_conntrack
Sep 5 10:45:41 user debug syslog: echo "1000" > /proc/sys/net/ipv4/ip_conntrack_max
Sep 5 10:45:41 user debug syslog: iptables -t nat -D PREROUTING -i br0 -d 192.168.0.100 -p udp --dport 53 -j DNAT --to 128.9.0.107 2>/dev/null
Sep 5 10:45:41 user debug syslog: iptables -t nat -D POSTROUTING -o ppp_0_0_35_1 -s 192.168.0.0/255.255.255.0 -j MASQUERADE 2>/dev/null
Sep 5 10:45:41 user debug syslog: iptables -t nat -A POSTROUTING -o ppp_0_0_35_1 -s 192.168.0.0/255.255.255.0 -j MASQUERADE
Sep 5 10:45:42 user debug syslog: kill -9 235
Sep 5 10:45:42 user debug syslog: echo > /var/hosts
Sep 5 10:45:44 user debug syslog: iptables -I INPUT 1 -p tcp --dport 80 -i ppp_0_0_35_1 -j ACCEPT
Sep 5 10:45:45 user debug syslog: iptables -I INPUT 1 -p icmp --icmp-type echo-request -i ppp_0_0_35_1 -j ACCEPT
Sep 5 10:45:45 user debug syslog: iptables -I INPUT 1 -p udp --dport 161 -i ppp_0_0_35_1 -j ACCEPT
Sep 5 10:45:45 user debug syslog: iptables -I INPUT 1 -p tcp --dport 23 -i ppp_0_0_35_1 -j ACCEPT
Sep 5 10:46:26 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.67.61 DST=92.125.107.222 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=58276 DF PROTO=TCP SPT=3916 DPT=135 WINDOW=64800 RES=0x00 SYN URGP=0
Sep 5 10:48:23 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.226.154 DST=92.125.107.222 LEN=48 TOS=0x00 PREC=0x00 TTL=252 ID=52692 DF PROTO=TCP SPT=3865 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Sep 5 10:49:54 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.65.38 DST=92.125.107.222 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=15621 DF PROTO=TCP SPT=45513 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Инет есть.
Мне кажется очень странным и интересным вот эта строчка:
Код:
Sep 5 10:45:42 user debug syslog: kill -9 235
И интересно, что это за процесс и что он делает.
пс: Прошивка 1.30