20 Apr
2009
20 Apr
'09
5:11 a.m.
How do I find out what is being downloaded ? or what program is the guilty one ?
assuming you have one nic connected to the modem
tcpdump -vv -i eth0 will dump all packets passing thru eth0
--
Rgds
JTD
--
here's something seemingly interesting:
------------------
Client-IP opium.local
Client-Ethernet-Address 00:13:20:24:d3:9c (oui Unknown)
[|bootp]
10:35:02.283333 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto
UDP (17), length 576) mygateway1.ar7.bootps > opium.local.bootpc:
BOOTP/DHCP, Reply, length 548, xid
sharukh@opium:~$ tail -f tcpdump.log
10:34:10.736003 IP (tos 0x0, ttl 46, id 16613, offset 0, flags [DF],
proto TCP (6), length 638) tibet108.server4you.de.https >
opium.local.48013: P 587:1173(586) ack 1172 win 816 <nop,nop,timestamp
171741530 726567>
10:34:10.736050 IP (tos 0x0, ttl 64, id 62638, offset 0, flags [DF],
proto TCP (6), length 52) opium.local.48013 >
tibet108.server4you.de.https: ., cksum 0x5c6d (correct), 1172:1172(0)
ack 1173 win 414 <nop,nop,timestamp 727012 171741530>
10:34:51.595111 IP (tos 0x0, ttl 39, id 8288, offset 0, flags [DF],
proto TCP (6), length 638) 192.108.114.19.9001 > opium.local.56648: P
587:1173(586) ack 1172 win 214 <nop,nop,timestamp 515952536 725310>
10:34:51.595160 IP (tos 0x0, ttl 64, id 22722, offset 0, flags [DF],
proto TCP (6), length 52) opium.local.56648 > 192.108.114.19.9001: .,
cksum 0x82a5 (correct), 1172:1172(0) ack 1173 win 432 <nop,nop,timestamp
737226 515952536>
10:34:56.585063 arp who-has opium.local tell mygateway1.ar7
10:34:56.585086 arp reply opium.local is-at 00:13:20:24:d3:9c (oui
Unknown)
10:35:02.003708 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 328) opium.local.bootpc > mygateway1.ar7.bootps:
BOOTP/DHCP, Request from 00:13:20:24:d3:9c (oui Unknown), length 300,
xid 0x4d76d060, Flags [none] (0x0000)
Client-IP opium.local
Client-Ethernet-Address 00:13:20:24:d3:9c (oui Unknown)
[|bootp]
10:35:02.283333 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto
UDP (17), length 576) mygateway1.ar7.bootps > opium.local.bootpc:
BOOTP/DHCP, Reply, length 548, xid
---------------------------------
who/what is this <tibet108.server4you.de.https>
regards,
Sharukh
--
Dr. Sharukh K. R. Pavri. Homoeopath, Linuxer.
Honi soit qui mal y pense. [Evil to him who evil thinks.] -- Motto
of the Order of the Garter (est. Edward III)
----- End forwarded message -----
--
Dr. Sharukh K R Pavri. Homoeopath, Linuxer.
Experience is what you get when you didn't get what you wanted.