The answer is in the way subnet masks and the way your ip address falls within those various subnets that you have defined. For netmask of 255.255.255.240 the 4 MSBs of the last octet are network addresses. This means that there are multiple networks defined in that space. Your ip address of your host is 147 which falls in the 144 network. It is easier to see with binary. 255.255.255.240 = FF.FF.FF.F0 F0 = 11110000 x.x.x.147 = x.x.x.10010011 This shows that this host is in the x.x.x.10010000 network (x.x.x.144) Did I get all that right? Clinton -----Original Message----- From: David Demland [mailto:ddemland@cadtel.com] Sent: Monday, September 25, 2000 2:26 PM To: PLUG Discussion Subject: Routing Table Problems I am still having a problem with the routing table on this Storm box. The following is the /etc/network/interfaces file: # /etc/network/interfaces -- configuration file for ifup(8), ifdown(8) # The loopback interface iface lo inet loopback iface eth0 inet static address 192.168.1.204 netmask 255.255.255.0 gateway 63.88.193.129 iface eth1 inet static address 63.88.193.147 netmask 255.255.255.240 gateway 63.88.193.129 broadcast 63.88.193.255 The ifconfig command output is: eth0 Link encap:Ethernet HWaddr 00:D0:B7:BF:AA:60 inet addr:192.168.1.204 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:5555 errors:0 dropped:0 overruns:0 frame:0 TX packets:45 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 Interrupt:10 eth1 Link encap:Ethernet HWaddr 00:D0:B7:BF:A6:C4 inet addr:63.88.193.147 Bcast:63.255.255.255 Mask:255.255.255.240 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:240 errors:0 dropped:0 overruns:0 frame:0 TX packets:53 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 Interrupt:9 Base address:0x2000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:3924 Metric:1 RX packets:14 errors:0 dropped:0 overruns:0 frame:0 TX packets:14 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 The route -n command output is: Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 63.88.193.144 0.0.0.0 255.255.255.240 U 0 0 0 eth1 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 My question, in the interfaces file the IP for eth1 is 63.88.193.147. The ifconfig command seems to reinforce this with the IP address of the same. But the route command has an IP of 63.88.193.144. Where in the world does this come from? Can anyone help? Thank You, David Demland Qa/Testing Manager CADTEL Systems, Inc. 11201 N. Tatum Ste. 200 Phoenix, AZ 85028 (602) 953-4888 Fax: (602) 953-4833 ddemland@cadtel.com ________________________________________________ See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't post to the list quickly and you use Netscape to write mail. Plug-discuss mailing list - Plug-discuss@lists.PLUG.phoenix.az.us http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss From Don Harrop Mon Sep 25 20:23:37 2000 From: Don Harrop (Don Harrop) Date: Mon, 25 Sep 2000 13:23:37 -0700 (MST) Subject: user tracking In-Reply-To: <200009251842.LAA04894@snappy.wiredglobal.com> Message-ID: Thanks for the responses. I never know about the command "last". Very cool. I've already found out most of what I needed. It was some guy over in Russia. Those punks! :-) He left some cool utilz on the hard drive for me though. A login replacement that logs all usernames and passwords and a in.ftpd replacement. That's how he got in in the first place. I was running wu-ftpd 2.5.x... I already know there's tons of documented exploits with that verison. I've just upgraded to wu-ftpd 2.6 so that should slow 'em down a little bit. Don On 26 Sep 2000, Bill Warner wrote: > This information is located in the /etc/shadow file. it is refrenced > in the standard unix time thing (seconds sense jan 1 1970) check > man shadow for more details > > Bill Warner > > > Hey guys. > > At login I get a printout of when the last login occured. Where > > is that info stored? I want to check out a user on the system but > > don't want to log in as them. One of the machines I work with had the > > root account compromised. It's just running a few mushes so it's not that > > big of deal but I don't want it happening again. I went through it with a > > fine tooth comb and wouldn't mind it if any of you guys tried to whack at > > it... Lemme know what you find. The IP is 205.216.140.17 > > > > Don > > > > > > ________________________________________________ > > See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't post to the list quickly and you use Netscape to write mail. > > > > Plug-discuss mailing list - Plug-discuss@lists.PLUG.phoenix.az.us > > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss > > > > > >