[cobalt-developers] Do I have a Squid problem???

[Denis Martin <dnsmrtn@xxxxxxxxx>]

Hi all,
        I have a Qube 3 at home...

        Recently I notice that my cable-modem activity
light was flashing quite a lot. I then looked at
netstat -n and found a huge number of hosts being
connected to my system. Do I have to say I was not
expecting this as I was not even running netscape on
my pc, nor did I on any system I have at home?

        I then tried to block connection from the
network where these hosts were from but gave up since
I was now at more than 150 entries in the firewall
table to be banned! I then decided to act differently
and block all the port I was not using explicitly and
allowing only the http port, telnet, ftp and about 5
others like nameservers etc. I was still getting lots
of traffic I was not expecting...

        So I went on the internet and got "sniffit",
installed it and ran it to find out packets were
coming and going to SQUID, or the cache server that
runs on the QUBE. I'm sure it has to do with it since
the port showed in sniffit is 3128 which happens to be
the one configured in the squid config file...

         When I stop the squid server the traffic goes
down a lot but I still see some packets going around
with sniffit eventhough I can't see any connection
with netstat. At least the packet rate/length is a lot
smaller than when it is active...

         Does anyone know of virus that attacks squid?
I found a packet that was coming from Davnet saying I
was banned on their server because of advertisement
sent to their network, on wich I have never
connected... They were recommending me to do a
virus/trojan scan on my system...

         How can I be sure squid works fine? I can't
believe it should cache stuff while I'm not active on
the internet!

         Thanks all for your help!

         Denis

         

______________________________________________________________________ 
Post your free ad now! http://personals.yahoo.ca