IP Spoofing?

From: John Evans (evansj@HI-LINE.NET)
Date: 03/04/98


I have the following three lines in my logs:

Mar  3 20:05:02 :: New connection from [017.255.020.000]
process_input: about to lose connection: No route to host
Mar  3 20:05:02 :: Losing descriptor without char.

These lines repeat approx. 30 times and are spaced from 3 to 35 seconds
apart. The two IPs involved are 017.255.020.000 and 086.221.006.008

I'm not sure if they are even valid IPs, but I checked the logs about 2
minutes after these connection attempts were made. I tried to ping those
IPs, and got nothing back at all. nslookup shows nothing on the IPs
either (but that doesn't mean a whole lot.)

The only changes that I have made to the connection procress is Eric
Green's ident code and some (ok, several) new CON_* states. My MUD is not
public at the moment as we are still building the world and in the latter
stages of code development. The only people that know the IP/Port of my
MUD are my staff and the admin of the MUD host.

Any ideas about what may be happening?

Thanks for any insight that you have to shed on this matter.

John Evans <evansj@hi-line.net>  --  http://www.hi-line.net/~evansj/

Any sufficiently advanced technology is indistinguishable from magic.
--Arthur C. Clarke


     +------------------------------------------------------------+
     | Ensure that you have read the CircleMUD Mailing List FAQ:  |
     | http://democracy.queensu.ca/~fletcher/Circle/list-faq.html |
     +------------------------------------------------------------+



This archive was generated by hypermail 2b30 : 12/15/00 PST