Seit ein paar Tagen sind Internet-Aktivitäten für mich zur Qual geworden, denn mein Modem ist ständig blockiert.
Ich habe einen Account bei freenet und stelle die Verbindung per wvdial mit einem Analog-Modem (56k) und zwischengeschaltetem Proxy wwwoffle her. Selbst wenn ich bei bestehender Verbindung nichts mache, reagieren die LEDs am Modem wie bei einem Download: Die Empfangs-LED leuchtet fast kontinuierlich und die Sende-LED blinkt ab und zu.

Ich habe die Firewall meines Kernels (2.4.23) aktiviert. Nach den Protokollen von syslog vermute ich, dass irgendjemand permanent versucht, meine Ports 135 und 445 zu öffnen.

Wie ich durch googlen herausgefunden habe, sind es wohl Windows-Würmer, die versuchen, über diese Ports einzubrechen.
Aber kann es sein, dass die Angriffe so massiv sind, dass sie mein Modem weitgehend lahm legen?
Oder habe ich vielleicht ein Rootkit/Wurm/Virus auf meinem Rechner und verbreite selbst schon irgend einen Mist?

Bitte helft mir – leider habe ich weder von Netzwerktechnik noch von Linux so viel Ahnung, um genau heraus zu finden, was da nun los ist.

Rolf

Hier ein paar Daten während einer Verbindung ohne Aktivitäten meinerseits: ulidor:/home/rolf # ifconfig
lo Protokoll:Lokale Schleife
inet Adresse:127.0.0.1 Maske:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:933 errors:0 dropped:0 overruns:0 frame:0
TX packets:933 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0
RX bytes:274453 (268.0 KiB) TX bytes:274453 (268.0 KiB)

ppp0 Protokoll:Punkt-zu-Punkt Verbindung
inet Adresse:213.7.101.144 P-z-P:62.104.206.35
Maske:255.255.255.255
UP PUNKTZUPUNKT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:43 errors:0 dropped:0 overruns:0 frame:0
TX packets:55 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0
RX bytes:19693 (19.2 KiB) TX bytes:6866 (6.7 KiB)

ulidor:/home/rolf # netstat -apn
Aktive Internetverbindungen (Server und stehende Verbindungen)
Proto Recv-Q Send-Q Local Address Foreign Address State
PID/Program name
tcp 0 0 0.0.0.0:32768 0.0.0.0:* LISTEN
510/rpc.statd
tcp 0 0 0.0.0.0:515 0.0.0.0:* LISTEN
524/lpd
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
397/portmap
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN
551/wwwoffled
tcp 0 0 0.0.0.0:8081 0.0.0.0:* LISTEN
551/wwwoffled
tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN
523/cupsd
tcp 0 0 127.0.0.1:32874 127.0.0.1:8081
VERBUNDEN 1434/wwwoffle
tcp 0 0 127.0.0.1:8081 127.0.0.1:32874
VERBUNDEN 551/wwwoffled
tcp 0 0 127.0.0.1:8081 127.0.0.1:32873
TIME_WAIT –
tcp 0 0 213.7.101.144:32870 62.104.23.42:80
TIME_WAIT –
tcp 0 0 213.7.101.144:32875 62.27.11.97:80
VERBUNDEN 1439/wwwoffled
tcp 0 0 213.7.101.144:32876 62.27.11.97:80
VERBUNDEN 1440/wwwoffled
tcp 0 0 213.7.101.144:32877 62.27.11.97:80
VERBUNDEN 1442/wwwoffled
tcp 0 0 213.7.101.144:32878 62.27.11.97:80
VERBUNDEN 1441/wwwoffled
udp 0 0 0.0.0.0:32768 0.0.0.0:*
510/rpc.statd
udp 0 0 0.0.0.0:686 0.0.0.0:*
510/rpc.statd
udp 0 0 0.0.0.0:111 0.0.0.0:*
397/portmap
Aktive Sockets in der UNIX Domäne (Server und stehende Verbindungen)
…
…
ulidor:/home/rolf # /sbin/iptables -L –line-numbers
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all — anywhere anywhere
2 LOG tcp — anywhere anywhere tcp
dpts:x11:6020 flags:SYN,RST,ACK/SYN LOG level warning
3 DROP tcp — anywhere anywhere tcp
dpts:x11:6020 flags:SYN,RST,ACK/SYN
4 LOG tcp — anywhere anywhere multiport
dports socks,2049 tcp flags:SYN,RST,ACK/SYN LOG level warning
5 DROP tcp — anywhere anywhere multiport
dports socks,2049 tcp flags:SYN,RST,ACK/SYN
6 LOG udp — anywhere anywhere multiport
dports 2049,4045 LOG level warning
7 DROP udp — anywhere anywhere multiport
dports 2049,4045
8 ACCEPT tcp — anywhere anywhere tcp
dpts:1024:65535 flags:!SYN,RST,ACK/SYN
9 ACCEPT tcp — anywhere anywhere tcp
dpt:www
10 REJECT tcp — anywhere anywhere tcp
dpt:auth reject-with tcp-reset
11 ACCEPT tcp — surfproxy.freenet.de anywhere tcp
spt:domain
12 ACCEPT udp — surfproxy.freenet.de anywhere udp
spt:domain
13 ACCEPT tcp — 62.104.196.134 anywhere tcp
spt:domain
14 ACCEPT udp — 62.104.196.134 anywhere udp
spt:domain
15 LOG icmp -f anywhere anywhere LOG level
warning
16 DROP icmp -f anywhere anywhere
17 ACCEPT icmp — anywhere anywhere icmp
echo-reply
18 ACCEPT icmp — anywhere anywhere icmp
destination-unreachable
19 ACCEPT icmp — anywhere anywhere icmp
source-quench
20 ACCEPT icmp — anywhere anywhere icmp
echo-request
21 ACCEPT icmp — anywhere anywhere icmp
time-exceeded
22 ACCEPT icmp — anywhere anywhere icmp
parameter-problem
23 DROP udp — anywhere anywhere udp
dpt:netbios-ns
24 LOG all — anywhere anywhere LOG level
warning
25 DROP all — anywhere anywhere

Chain FORWARD (policy DROP)
num target prot opt source destination
1 ACCEPT all — anywhere anywhere state
NEW,RELATED,ESTABLISHED
2 ACCEPT all — anywhere anywhere state
RELATED,ESTABLISHED

Chain OUTPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all — anywhere anywhere
2 ACCEPT udp — anywhere anywhere udp
spts:1024:65535 dpt:domain
3 ACCEPT tcp — anywhere anywhere tcp
spt:ssh
4 ACCEPT tcp — anywhere anywhere tcp
spt:www
5 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:ftp
6 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:ssh
7 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:telnet
8 ACCEPT tcp — anywhere anywhere tcp
dpt:smtp
9 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:time
10 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:whois
11 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:domain
12 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:finger
13 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:www
14 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:pop3
15 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:nntp
16 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:imap2
17 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:https
18 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpt:554
19 ACCEPT tcp — anywhere anywhere tcp
spts:1024:65535 dpts:1024:65535
20 ACCEPT icmp — anywhere anywhere icmp
echo-reply
21 ACCEPT icmp — anywhere anywhere icmp
destination-unreachable
22 ACCEPT icmp — anywhere anywhere icmp
echo-request
23 LOG all — anywhere anywhere LOG level
warning
24 REJECT tcp — anywhere anywhere
reject-with tcp-reset
25 DROP all — anywhere anywhere
ulidor:/home/rolf #

Ein Auszug aus syslog:
…
…
Oct 30 11:02:21 ulidor pppd[1340]: pppd 2.4.1 started by rolf, uid 1000
Oct 30 11:02:21 ulidor pppd[1340]: Using interface ppp0
Oct 30 11:02:21 ulidor pppd[1340]: Connect: ppp0 /dev/ttyS0
Oct 30 11:02:21 ulidor /etc/hotplug/net.agent: assuming ppp0 is already up
Oct 30 11:02:24 ulidor pppd[1340]: Cannot determine ethernet address for
proxy ARP
Oct 30 11:02:24 ulidor pppd[1340]: local IP address 213.7.101.144
Oct 30 11:02:24 ulidor pppd[1340]: remote IP address 62.104.206.35
Oct 30 11:02:24 ulidor pppd[1340]: primary DNS address 62.104.191.241
Oct 30 11:02:24 ulidor pppd[1340]: secondary DNS address 62.104.196.134
Oct 30 11:02:26 ulidor wwwoffled[551]: WWWOFFLE Connection from host
ulidor (127.0.0.1).
Oct 30 11:02:26 ulidor wwwoffled[551]: WWWOFFLE Online.
Oct 30 11:02:26 ulidor wwwoffled[551]: WWWOFFLE Connection from host
ulidor (127.0.0.1).
Oct 30 11:02:26 ulidor wwwoffled[551]: WWWOFFLE Fetch.
Oct 30 11:02:36 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.183.52
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=27998 DF PROTO=TCP
SPT=3504 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:02:51 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.110.65
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=8431 DF PROTO=TCP
SPT=3473 DPT=135 WINDOW=25200 RES=0x00 SYN URGP=0
Oct 30 11:02:54 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.205.94
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=16347 DF PROTO=TCP
SPT=1640 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:02:54 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.205.94
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=16494 DF PROTO=TCP
SPT=1640 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:03:00 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.7.154
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=53677 DF PROTO=TCP
SPT=3452 DPT=135 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:03:05 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.7.154
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=53896 DF PROTO=TCP
SPT=3452 DPT=135 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:03:07 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.76.164
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=6534 DF PROTO=TCP
SPT=3529 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:03:07 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.252.47
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=38625 DF PROTO=TCP
SPT=3658 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:03:07 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.57.208
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=19894 DF PROTO=TCP
SPT=3257 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:03:10 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.76.164
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=6665 DF PROTO=TCP
SPT=3529 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:03:10 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.252.47
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=38888 DF PROTO=TCP
SPT=3658 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:03:25 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.66.182.201
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=42436 DF PROTO=TCP
SPT=4714 DPT=135 WINDOW=64240 RES=0x00 SYN URGP=0
Oct 30 11:03:30 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.66.182.201
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=42603 DF PROTO=TCP
SPT=4714 DPT=135 WINDOW=64240 RES=0x00 SYN URGP=0
Oct 30 11:03:36 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.23.232.176
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=9948 DF PROTO=TCP
SPT=2956 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 30 11:03:38 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.23.232.176
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=10405 DF PROTO=TCP
SPT=2956 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 30 11:03:56 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.217.64
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=62293 DF PROTO=TCP
SPT=3907 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:03:59 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.217.64
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=62591 DF PROTO=TCP
SPT=3907 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:04:03 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.251.28
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=20818 DF PROTO=TCP
SPT=2390 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:04:04 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.206.198
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=24196 DF PROTO=TCP
SPT=2329 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0
Oct 30 11:04:10 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.121.42
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=11168 DF PROTO=TCP
SPT=4438 DPT=135 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:04:11 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.121.42
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=11348 DF PROTO=TCP
SPT=4438 DPT=135 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:04:14 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.151.215
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=43946 DF PROTO=TCP
SPT=3722 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:04:21 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.151.215
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=44162 DF PROTO=TCP
SPT=3722 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:04:33 ulidor wwwoffles[1452]: Cannot unlink backup cached file
‘http/www.eventim.de/DBY4QbEg9H6CJxv4ADnzQQA~’ [No such file or
directory].
Oct 30 11:04:41 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.201.58
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=37740 DF PROTO=TCP
SPT=2791 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:04:43 ulidor kernel: IN=ppp0 OUT= MAC= SRC=213.7.201.58
DST=213.7.101.144 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=37873 DF PROTO=TCP
SPT=2791 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0
Oct 30 11:04:52 ulidor pppd[1340]: Terminating on signal 15.
Oct 30 11:04:52 ulidor wwwoffled[551]: WWWOFFLE Connection from host
ulidor (127.0.0.1).
Oct 30 11:04:52 ulidor wwwoffled[551]: WWWOFFLE Offline.
Oct 30 11:04:54 ulidor /etc/hotplug/net.agent: invoke ifdown ppp0
Oct 30 11:06:46 ulidor wwwoffles[1466]: Error reading reply body from
remote host [Connection timed out].
Oct 30 11:06:49 ulidor wwwoffles[1461]: Error reading reply body from
remote host [Connection timed out].
Oct 30 11:06:51 ulidor wwwoffles[1456]: Error reading reply body from
remote host [Connection timed out].
Oct 30 11:06:51 ulidor wwwoffles[1459]: Error reading reply body from
remote host [Connection timed out].
Oct 30 11:06:51 ulidor wwwoffled[551]: WWWOFFLE Fetch finished.
…
…