Alert message! Fra router.

[klokka]

Noen som kan si meg hva dette er og hva jeg kan gjøre med det?

 

Får hele tiden mail om at noen vil komme seg inn på nettverket mitt. Ca. 1 gang i timen.

Og alltid er det fra samme ip.

 

Her er en av mailene;

 

Dear User

Your router has detected and protected you against an attempt to gain access to your network. This may have been an attempted hacker intrusion, or perhaps just your Internet Service Provider doing routine network maintenance. Most of these network probes are nothing to be worried about - these types of random probes should NOT be reported, but you may want to report repeated intrusions attempts. Save this email for comparison with future alert messages. Your router Alert Information

 

Time: 06/28/2004, 14:52:07

Message: IP Spoofing

Source: 127.0.0.1, 80

Destination:##.##.###.##, #### (from WAN Inbound)

 

 

Visit the UXN Combat Spam web site to get more detailed information about the intruder - http://combat.uxn.com/ 1. Type the intruder's IP address into the IP WHOIS search engine 2. Click the Query Button 3. Detailed network and administration information will be displayed.

 

Og når jeg da søker på UXN får jeg dette opp;

 

whois -h whois.ripe.net. "127.0.0.1"

The RIPE NCC is the European Center for co-ordinating and allocating Internet addressing space. IP addresses are allocated in blocks of either Class A, B or C addresses. There are 128 Class A addresses in total, and half of these have already been allocated - one class A provides several million host addresses. There are 65,000+ Class B addresses - each providing over 60,000 host addresses. And finally there are Class C's, each offering aproximately 250 addresses. If you wish to connect a network to the Internet, you need to obtain unique addresses for each host, and to ensure they are unique, you need to register them with some central body. The RIPE are responsible for providing/reserving address space within Europe, and to provide a database of who-owns-what. See www.ripe.net for more information.

 

% This is the RIPE Whois server.

% The objects are in RPSL format.

%

% Rights restricted by copyright.

% See http://www.ripe.net/ripencc/pub-services/db/copyright.html

 

inetnum: 0.0.0.0 - 255.255.255.255

netname: IANA-BLK

descr: The whole IPv4 address space

country: EU # Country is really world wide

org: ORG-IANA1-RIPE

admin-c: IANA1-RIPE

tech-c: IANA1-RIPE

status: ALLOCATED UNSPECIFIED

remarks: The country is really worldwide.

remarks: This address space is assigned at various other places in

remarks: the world and might therefore not be in the RIPE database.

mnt-by: RIPE-NCC-HM-MNT

mnt-lower: RIPE-NCC-HM-MNT

mnt-routes: RIPE-NCC-RPSL-MNT

changed: [email protected] 20010529

changed: [email protected] 20020625

changed: [email protected] 20031014

changed: [email protected] 20040422

changed: [email protected] 20040504

source: RIPE

 

organisation: ORG-IANA1-RIPE

org-name: Internet Assigned Numbers Authority

org-type: IANA

address: see http://www.iana.org

remarks: The IANA allocates IP addresses and AS number blocks to RIRs

remarks: see http://www.iana.org/ipaddress/ip-addresses.htm

remarks: and http://www.iana.org/assignments/as-numbers

e-mail: [email protected]

admin-c: IANA1-RIPE

tech-c: IANA1-RIPE

mnt-ref: RIPE-NCC-HM-MNT

mnt-by: RIPE-NCC-HM-MNT

changed: [email protected] 20040417

source: RIPE

 

role: Internet Assigned Numbers Authority

address: see http://www.iana.org.

e-mail: [email protected]

admin-c: IANA1-RIPE

tech-c: IANA1-RIPE

nic-hdl: IANA1-RIPE

remarks: For more information on IANA services

remarks: go to IANA web site at http://www.iana.org.

mnt-by: RIPE-NCC-MNT

changed: [email protected] 20010411

source: RIPE

[Erijk]

Du kan skru av det i routeren din så han ikke skal si ifra.. !

[reybr]

Er jo ingen grunn til å prøve et whois oppslag mot 127.0.0.1 ettersom dette er den lokale IPen din. Og som routeren sier, er dette et "angrep" hvor noen spoofer, altså forfalsker, IP adresseren til avsenderen. (Også en grunn til at det ikke hjelper å slå opp IPen på whois).

 

Ikke noe å gjøre med dette. Bare å ignorere

[klokka]

Er jo ingen grunn til å prøve et whois oppslag mot 127.0.0.1 ettersom dette er den lokale IPen din. Og som routeren sier, er dette et "angrep" hvor noen spoofer, altså forfalsker, IP adresseren til avsenderen. (Også en grunn til at det ikke hjelper å slå opp IPen på whois).

 

Ikke noe å gjøre med dette. Bare å ignorere

Det er ikke min lokale ip. Hverken lokalt eller wan

[agvg]

Det er ikke min lokale ip. Hverken lokalt eller wan

Joda, alle maskiner har denne IP-en for internt bruk.

[klokka]

Joda, alle maskiner har denne IP-en for internt bruk.

Ok men da er saken løst