hlasky binda a trinoo

[Martin Povolny]

Procital jsem logy binda na jednom ze serveru a narazil jsem na nasledujici 
veci:

<CITE>
ns_forw: query(55.39.117.211.in-addr.arpa) All possible A RR's lame
bad referral (46.203.151.in-addr.arpa !< 47.46.203.151.in-addr.arpa)
</CITE>

Muzete mi prosim nekdo rici, co to znamena (predem diky) ?

Potom jsem tam jeste nasel (viz nize), coz sice vim, co znamena, ale nelibilo
se mi to, takze jsem si ony stroje zkusil resolvnout, a nmapnout a dostal 
jsem zajimavou vec:

<CITE>
unapproved AXFR from [200.231.203.3].4213 for "deto.cz" (acl)
unapproved AXFR from [213.167.217.17].4347 for "m-l.cz" (acl)
</CITE>

martin na inferno:~$ nmap 213.167.217.17

Starting nmap V. 2.54BETA7 ( www.insecure.org/nmap/ )
Interesting ports on  (213.167.217.17):
(The 1511 ports scanned but not shown below are in state: closed)
Port       State       Service
7/tcp      open        echo                    
9/tcp      open        discard                 
13/tcp     open        daytime                 
17/tcp     open        qotd                    
19/tcp     open        chargen                 
21/tcp     open        ftp                     
25/tcp     open        smtp                    
80/tcp     open        http                    
135/tcp    open        loc-srv                 
139/tcp    open        netbios-ssn             
389/tcp    open        ldap                    
443/tcp    open        https                   
548/tcp    open        afpovertcp              
1002/tcp   open        unknown                 
1025/tcp   open        listen                  
1026/tcp   open        nterm                   
1032/tcp   open        iad3                    
12345/tcp  filtered    NetBus                  
12346/tcp  filtered    NetBus                  
27665/tcp  filtered    Trinoo_Master           
31337/tcp  filtered    Elite                   
32773/tcp  filtered    sometimes-rpc9          
54320/tcp  filtered    bo2k  

Co si o tom myslite ? Ze by ten stroj fungoval jako trinoo master server (a 
pres binda hleda dalsi obeti), nebo jen administrator zamerne filtruje tyto 
porty (to se mi zda nepravdepodobne) ?

Diky za vasi pozornost a omlouvam se za dlouhy mail,

-- 
Martin Povolný, xpovolny na fi.muni.cz, http://www.fi.muni.cz/~xpovolny