|
前天检查router的时候,发现的一个郁闷问题:
root@homegw bpxyz # netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN
tcp 0 0 211.158.69.183:139 169.254.193.218:3001 SYN_RECV
tcp 0 0 211.158.69.183:139 169.254.193.218:4939 SYN_RECV
tcp 0 0 211.158.69.183:139 169.254.193.218:4719 SYN_RECV
tcp 0 0 211.158.69.183:139 169.254.193.218:3096 SYN_RECV
tcp 0 0 211.158.69.183:139 169.254.193.218:3314 SYN_RECV
tcp 0 0 211.158.69.183:139 169.254.193.218:4895 SYN_RECV
tcp 0 0 211.158.69.183:139 169.254.193.218:4607 SYN_RECV
tcp 0 0 211.158.69.183:139 169.254.193.218:4512 SYN_RECV
tcp 0 0 211.158.69.183:139 169.254.193.218:4824 SYN_RECV
tcp 0 0 211.158.69.183:139 169.254.193.218:4180 SYN_RECV
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN
tcp 0 0 :::80 :::* LISTEN
tcp 0 0 :::22 :::* LISTEN
tcp 0 132 ::ffff:172.16.100.25:22 ::ffff:172.16.100.:1284 ESTABLISHED
怎么会有这么多的SYN_RECV?而且地址Foreign Address居然是169.254.x.x?麻烦知情者帮个忙,告诉一下为什么会这样?是不是被攻击了? :ask
注:OS:Gentoo2004.3 ppp0: 211.158.69.183 共有4张网卡,接三个网络用于路由和三个网络的文件共享。当出现这个问题的时候,firewall没有禁止ppp0上的139通讯。 |
|