Re: [cobalt-users] Strange RaQ behavior??

[flash22@xxxxxxx]

On Wed, 12 Dec 2001, Wayne Sagar wrote:

> I love it when we get all paranoid! But...
> 
> Dec 12 11:01:00 www kernel: Packet log: input DENY eth0 PROTO=6 
> my.new.ip.addy:3013 my.old.ip.addy:113 L=60 S=0x00 I=50348 F=0x4000 T=54 SYN 

It's a side effect of the other machine trying to send you emaul, your new
machine is trying to access identd on the other machine, that is normal
(it wants to verify the id of the claimed user on the other mahcine)

[113 = ident service] sendmail by default does this....
> 
> Connects from my new box are via various higher ports, which incidently are 
> not listed in /etc/services

Right, because they are outbount, and thus can not be priviliged...

> Could I be rooted at the new box???? No other signs, other than the damn 
> gmon.out files that have been created here and there on the new box for 

Dount it, not from just that, tho, i'd love to poke about on a virgin
machine and see what is dumping trace files all over the place ;)

gsh