linux-kernel - Re: what does this mean: "kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070823154244.GA15919@piper.oerlikon.madduck.net>
Date:	Thu, 23 Aug 2007 17:42:44 +0200
From:	martin f krafft <madduck@...duck.net>
To:	linux-kernel@...r.kernel.org
Subject: Re: what does this mean: "kernel: 7.0.0.1:53 L=79 S=0x00 I=39869
	F=0x4000 T=64"

also sprach Alexander E. Patrakov <patrakov@....usu.ru> [2007.08.23.1730 +0200]:
>> I am staring at this log message:
>>   kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64
>> and I cannot figure out what it's trying to tell me. Could someone
>> please enlighten me?
>
> Looks like some DNS packet got logged by your firewall rules.

But my firewall rules certainly do not log DNS packets, and if they
did, it would look very differently, no? I always prefix my iptables
LOG messages anyway.

This is a Xen client, if it makes a difference.

Now looking at it, it looks as if the log got garbled and 7.0.0.1:53
is really part of 127.0.0.1:53 (the machine does run a recursor).

Can stuff like this happen that data is lost in this way before
syslog can dump it?

-- 
martin;              (greetings from the heart of the sun.)
  \____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@...duck
 
"convictions are more dangerous enemies of truth than lies."
                                                 - friedrich nietzsche
 
spamtraps: madduck.bogus@...duck.net

Download attachment "digital_signature_gpg.asc" of type "application/pgp-signature" (190 bytes)