hlasky binda a trinoo

[Jaroslav Stefka]

Docela dobry popis hlaseni binda lze nalezt na
http://www.acmebw.com/askmrdns/bind-messages.htm

> 
> <CITE>
> ns_forw: query(55.39.117.211.in-addr.arpa) All possible A RR's lame
> bad referral (46.203.151.in-addr.arpa !< 47.46.203.151.in-addr.arpa)
> </CITE>
> 
> Muzete mi prosim nekdo rici, co to znamena (predem diky) ?
> 
> Potom jsem tam jeste nasel (viz nize), coz sice vim, co znamena, ale nelibilo
> se mi to, takze jsem si ony stroje zkusil resolvnout, a nmapnout a dostal 
> jsem zajimavou vec:
> 
> <CITE>
> unapproved AXFR from [200.231.203.3].4213 for "deto.cz" (acl)
> unapproved AXFR from [213.167.217.17].4347 for "m-l.cz" (acl)
> </CITE>
> 
> martin na inferno:~$ nmap 213.167.217.17
> 
> Starting nmap V. 2.54BETA7 ( www.insecure.org/nmap/ )
> Interesting ports on  (213.167.217.17):
> (The 1511 ports scanned but not shown below are in state: closed)
> Port       State       Service
> 7/tcp      open        echo                    
> 9/tcp      open        discard                 
> 13/tcp     open        daytime                 
> 17/tcp     open        qotd                    
> 19/tcp     open        chargen                 
> 21/tcp     open        ftp                     
> 25/tcp     open        smtp                    
> 80/tcp     open        http                    
> 135/tcp    open        loc-srv                 
> 139/tcp    open        netbios-ssn             
> 389/tcp    open        ldap                    
> 443/tcp    open        https                   
> 548/tcp    open        afpovertcp              
> 1002/tcp   open        unknown                 
> 1025/tcp   open        listen                  
> 1026/tcp   open        nterm                   
> 1032/tcp   open        iad3                    
> 12345/tcp  filtered    NetBus                  
> 12346/tcp  filtered    NetBus                  
> 27665/tcp  filtered    Trinoo_Master           
> 31337/tcp  filtered    Elite                   
> 32773/tcp  filtered    sometimes-rpc9          
> 54320/tcp  filtered    bo2k  
> 
> Co si o tom myslite ? Ze by ten stroj fungoval jako trinoo master server (a 
> pres binda hleda dalsi obeti), nebo jen administrator zamerne filtruje tyto 
> porty (to se mi zda nepravdepodobne) ?
> 
> Diky za vasi pozornost a omlouvam se za dlouhy mail,
> 
> -- 
> Martin Povolný, xpovolny na fi.muni.cz, http://www.fi.muni.cz/~xpovolny