I am staring at this log message:
kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64
and I cannot figure out what it's trying to tell me. Could someone
please enlighten me?
--
martin; (greetings from the heart of the sun.)
\____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
a common mistake that people make
when trying to design something completely foolproof
was to underestimate the ingenuity of complete fools.
-- douglas adams, "mostly harmless"
spamtraps: [email protected]
martin f krafft wrote:
> I am staring at this log message:
>
> kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64
>
> and I cannot figure out what it's trying to tell me. Could someone
> please enlighten me?
Looks like some DNS packet got logged by your firewall rules.
--
Alexander E. Patrakov
also sprach Alexander E. Patrakov <[email protected]> [2007.08.23.1730 +0200]:
>> I am staring at this log message:
>> kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64
>> and I cannot figure out what it's trying to tell me. Could someone
>> please enlighten me?
>
> Looks like some DNS packet got logged by your firewall rules.
But my firewall rules certainly do not log DNS packets, and if they
did, it would look very differently, no? I always prefix my iptables
LOG messages anyway.
This is a Xen client, if it makes a difference.
Now looking at it, it looks as if the log got garbled and 7.0.0.1:53
is really part of 127.0.0.1:53 (the machine does run a recursor).
Can stuff like this happen that data is lost in this way before
syslog can dump it?
--
martin; (greetings from the heart of the sun.)
\____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
"convictions are more dangerous enemies of truth than lies."
- friedrich nietzsche
spamtraps: [email protected]
martin f krafft wrote:
> also sprach Alexander E. Patrakov <[email protected]> [2007.08.23.1730 +0200]:
>>> I am staring at this log message:
>>> kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64
>>> and I cannot figure out what it's trying to tell me. Could someone
>>> please enlighten me?
>> Looks like some DNS packet got logged by your firewall rules.
>
> But my firewall rules certainly do not log DNS packets, and if they
> did, it would look very differently, no? I always prefix my iptables
> LOG messages anyway.
Sorry. Indeed, it differs very much from the normal packet log and
cannot be obtained by truncation:
Aug 20 13:25:39 dsa kernel: packet trace: IN=eth0 OUT=eth2
SRC=192.168.0.96 DST=192.36.143.150 LEN=76 TOS=0x00 PREC=0x00 TTL=63
ID=0 DF PROTO=UDP SPT=123 DPT=123 LEN=56
> This is a Xen client, if it makes a difference.
None of the results of grep -r 'L=%' linux-2.6.22.1 match your string.
So this must indeed be something out-of-tree - but Xen-3.1.0 or 3.0.4
doesn't match either. Or function that produced this message in the log
doesn't use printf-like functions for formatting numbers.
However, the style does look similar to a message in ipw2100.c:
IPW_DEBUG_TX("TX%d V=%p P=%04X T=%04X L=%d\n", i,
&txq->drv[i],
(u32) (txq->nic + i * sizeof(struct ipw2100_bd)),
txq->drv[i].host_addr, txq->drv[i].buf_length);
--
Alexander E. Patrakov
also sprach Alexander E. Patrakov <[email protected]> [2007.08.23.1847 +0200]:
> However, the style does look similar to a message in ipw2100.c:
>
> IPW_DEBUG_TX("TX%d V=%p P=%04X T=%04X L=%d\n", i,
> &txq->drv[i],
> (u32) (txq->nic + i * sizeof(struct ipw2100_bd)),
> txq->drv[i].host_addr, txq->drv[i].buf_length);
This is not being used on the machine.
--
martin; (greetings from the heart of the sun.)
\____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
"never attribute to malice what can be
adequately explained by incompetence."
-- mark twain
spamtraps: [email protected]