Re: Solaris 7 installation is sending 127.0.0.0/8 addresses on the ethernet network...

Hi Michael,

my previous message jumped the gun a bit, about the 127.0.0.0/8 routing... So here's round two ;)

> Date: Tue, 26 Nov 2002 15:41:28 +0800

> [ ... ]

> [... ]

OK, so it's your NIC, destined for you default route ?

> Internet Protocol, Src Addr: 127.0.0.75 (127.0.0.75), Dst Addr: 108.122.0.0 (108.122.0.0)

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

OK, it's an IPv4 packet.

> Header length: 20 bytes

Hm... with a proto of '0', which according to http://www.iana.org/assignments/protocol-numbers is the "IPv6 Hop-by-Hop Option" from RFC1883 (IPv6)...

Very strange, this is something which points to IPv6 traffic, but then it has to be an IPv6 packet, where the "Next Header" field holds those ("Protocol Number") values as opposed to the "Protocol" field in IPv4.

> Header checksum: 0xa853 (correct)

Hm... now it's getting funny:
jpv@jp-gp: ~ $ whois 108.122.0.0
[ ... ]
OrgName: Internet Assigned Numbers Authority OrgID: IANA
NetRange: 96.0.0.0 - 126.255.255.255

NetName:    RESERVED-8
NetType:    IANA Reserved
Updated:    2002-09-12

Could you post some more information about the setup of the machine, network-wise ? Do you run ethereal on the SUN, or somewhere else on the wire ? Could you run it on both locations ?

What processes do you have running on your SUN, perhaps we can nail the source down to one of them and start looking closer at one of them...

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

> Please advice.

Kind regards,
JP Velders Received on Tue Dec 3 18:40:58 2002