>> Edit article

			이름
			제목
			패스워드

IDC가서 서버에 콘솔을 연결했는데.. login: 이라는 프로프트 대신.. Suspect short first fragment. eth0 PROTO=17 212.15.64.14: 210.112.112.115:0 L=20 S=0x00 I=40960 F=0x4000 T=116 위와 같은 메세지가 연거푸 나와 있었습니다. 아이피는 외국 아이피 대역인것 같습니다. (212.15.64.14) 이곳저곳 뒤져봤는데 보안 관련 로그 같기도 하고.. 다음과 같은 글을 찾았는데.. ==== Most probably it is not an attack but a scanning of your machine for services. In short technical: IPv4 uses a feature called fragmentation to permit networks with different MTUs (that's maximum packet size) to communicate with each other. The minimum really used MTU in the internet is about 550 bytes. If you ever see a first fragment of an IP packet that is less than say 500 bytes it is probably someone trying to split the packets he sends into small peaces (fragments) so that your filtering software not notice the real destination of the packet itself. To be effective his/her attack they need to send a fragment of less than the size of the transport/session layer header, which in this case is (UDP header=) 8 bytes, So they sent an IP packet fragmented into peaces so that the first peace carries only the first byte of the udp header, and your linux kernel noticed that it is not normal to receive a first fragment so short. ===== 영어가 영 딸리네요.. 해석이나 관련된 한글 문서를 좀 볼수 없을까요?? 재미 있는것은 답을 찾으려 다니던중 이와 같은 질문에서 나온 IP는 모두 C클래스...마지막 IP만 다르더군요..^^: 우연인지.. 스팸메일서버로 쓰려고 스캐닝 한걸까요?? 답변 부탁 드리겠습니다. 미리 감사드립니다.

Copyleft 1999-2026 by JSBoard Open Project Theme Designed by IDOO All right reserved