Am I Attacking MySelf? [SOLVED - and it was yes, sort of]

padukes · Apprentice Joined: 27 Feb 2003 Posts: 232

Hi All,

Lets imagine that my ip address is "1.2.3.4". About every 10 minutes I see two packets in my iptables log that look like they are coming from me and are being sent near my subnet. However, instead of going to 1.2.3.255 they go to 1.2.4.255. The machine that holds that IP is running gentoo and acting as my firewall to several windows (and linux) machines behind it. Am I somehow attacking myself? Any ideas what is causing these packets (every friggin 10 minutes)?

Mark Clegg · Posted: Thu Nov 10, 2005 6:44 pm Post subject:

Well first I'd check /etc/conf.d/net. If you're using a static IP address, I'd geuss you've set the broadcast address wrong, and that would explain the 1.2.4.255 instead of 1.2.3.255 (assuming a subnet mask of 255.255.255.0). Can you post an ifconfig -a ?

Secondly, your iptables log shows UDP port 138, that's netbios, so I'd be looking for a samba process, on the local machine,.

padukes · Apprentice Joined: 27 Feb 2003 Posts: 232

Hi Mark,

Here's the relevant portion from my ifconfig (I have a dynamic IP with the real IP replaced):

think4urs11 · Posted: Thu Nov 10, 2005 7:55 pm Post subject:

the 10 minutes are because that how netbios works.
Your samba announces itself into the network every 10 minutes.

Reconfigure samba to listen only on your internal interface
in setion [global], parameter interfaces
_________________
Nothing is secure / Security is always a trade-off with usability / Do not assume anything / Trust no-one, nothing / Paranoia is your friend / Think for yourself

padukes · Apprentice Joined: 27 Feb 2003 Posts: 232

Thanks all!

It appears that it was Samba. I changed the various interface params but I think it was this in the [global] section that did the trick:

remote announce = 192.168.0.1/255.255.255.0

Thanks for the help,
P