Spurious appearance of tap and eq interfaces?

phceac · n00b Joined: 31 Aug 2003 Posts: 12

I was idly doing an ifconfig, to see if my adsl connection was still up, when I noticed two unexpected interfaces:

eql Link encap:Serial Line IP
MASTER MTU:576 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:5
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

tap0 Link encap:Ethernet HWaddr FE:FD:00:00:00:00
BROADCAST NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

This is the first time I've seen these, and I'm not running anything which should be starting them - at least, not that I know of. A few minutes later they had gone.

I've googled around without success...can anyone tell me where these interfaces came from and went to?

Thanks for any hints,

Charlie

bone · Posted: Thu Jun 17, 2004 12:39 am Post subject:

You must have added those interfaces when you redid your kernel. eql = equal line/load balancing, and most likely you do not need it. tap, I cant remember what it is associated with, something about encapsulated tunnels comes to mind but I am not entirely 100% on that. The presence of these interfaces should not hurt you at all, but you will have to redo your kernel to get rid of them.

pjp · Administrator Joined: 16 Apr 2002 Posts: 20589

Aren't tap devices used for VPN software?
_________________
Quis separabit? Quo animo?

phceac · n00b Joined: 31 Aug 2003 Posts: 12

The VPN aspect makes this a bit scary...do I have an uninvited user?

> You must have added those interfaces when you redid your kernel.
I do have CONFIG_ETHERTAP=y in the kernel config, which looks like the option for tap devices. I'll have a look to see what the option is for the eql interface. Don't these only provide the capability to create the interfaces in the kernel or in modules?

I just don't understand who actually set the interfaces up.
And who took them down again almost immediately, not to be seen since? I can't think of anything I've run which would do this.

Have I been hacked, or is there an innocent explanation??

Cheers

Charlie

phceac · n00b Joined: 31 Aug 2003 Posts: 12

Doh!

Must have done a "ifconfig -a", which shows all the interfaces, even the ones which are down. Got my netstat and ifconfig confused.
I didn't notice that tap0 and eql weren't flagged as UP.

Feeling really stupid now....sorry for the waste of time.

Thanks for the help,

C