Bugtraq mailing list archives
strange behavior on Cisco 2801
From: "Marcin" <sec () firlag pl>
Date: Thu, 1 Feb 2007 20:46:33 +0100
Hi! im running Cisco IOS software on 2801 router (C2801-ADVIPSERVICESK9-M), Version 12.4(3e), RELEASE SOFTWARE (fc2). I have few problems and i have seen strange behavior: after few hours there was no responding from router, no nat etc. After restart everything was ok for 10-12 hours. I have ONLY one user name to permit logon via ssh to router: marcin and not dictionary password (14 symbols) I logon 2 hours ago and i use command "who". I was very surprised, because i saw something in 1 minute 2 different usernames and NO USERNAME on vty 194. i looks like that: router#who Line User Host(s) Idle Location vty 194 idle 00:00:01 nt.math.nknu.edu.tw * vty 195 marcin idle 00:00:00 210-az4-2.acn.waw.pl Interface User Mode Idle Peer Address router#who Line User Host(s) Idle Location vty 194 aivankovic idle 00:00:04 nt.math.nknu.edu.tw * vty 195 marcin idle 00:00:00 210-az4-2.acn.waw.pl Interface User Mode Idle Peer Address router#who Line User Host(s) Idle Location vty 194 idle 00:00:01 nt.math.nknu.edu.tw * vty 195 marcin idle 00:00:00 210-az4-2.acn.waw.pl Interface User Mode Idle Peer Address router#who Line User Host(s) Idle Location vty 194 aivankovic idle 00:00:04 nt.math.nknu.edu.tw * vty 195 marcin idle 00:00:00 210-az4-2.acn.waw.pl router#who Line User Host(s) Idle Location vty 194 idle 00:00:01 nt.math.nknu.edu.tw * vty 195 marcin idle 00:00:00 210-az4-2.acn.waw.pl router#sh users Line User Host(s) Idle Location vty 194 akrizan idle 00:00:40 nt.math.nknu.edu.tw * vty 195 marcin idle 00:00:00 210-az4-2.acn.waw.pl What is going on? have you heard about similar incident? Best regards Marcin
Current thread:
- strange behavior on Cisco 2801 Marcin (Feb 01)
- Re: strange behavior on Cisco 2801 Neil Anderson (Feb 01)
- Sourceforge compromized? Michael Scheidell (Feb 02)
- Re: Sourceforge compromized? Eliah Kagan (Feb 02)
- Re: Sourceforge compromized? Serguei A. Mokhov (Feb 02)
- Re: Sourceforge compromized? Tim (Feb 02)
- Re: Sourceforge compromized? Karl Schlitt (Feb 02)
- Sourceforge compromized? Michael Scheidell (Feb 02)
- Re: strange behavior on Cisco 2801 Neil Anderson (Feb 01)
- Re: strange behavior on Cisco 2801 Eloy Paris (Feb 02)