-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I also ran the same commands on my laptop running SuSE 9.3 and came up with similar results. In my case however the 'alien' IP always login at the same time as my normal login here's as $ last -i manulite :0 96.92.235.183 Thu Oct 27 10:46 still logged in manulite :0 0.0.0.0 Thu Oct 27 10:46 - 10:46 (00:00) ... manulite :0 96.92.235.183 Wed Oct 26 13:28 - 20:08 (06:39) manulite :0 0.0.0.0 Wed Oct 26 13:28 - 13:28 (00:00) ... manulite :0 96.92.235.183 Wed Oct 26 12:03 - 13:25 (01:21) manulite :0 0.0.0.0 Wed Oct 26 12:03 - 12:03 (00:00) ... manulite :0 96.92.235.183 Wed Oct 26 00:11 - 01:22 (01:11) manulite :0 0.0.0.0 Wed Oct 26 00:11 - 00:11 (00:00) ... manulite :0 96.92.235.183 Tue Oct 25 10:47 - 23:01 (12:13) manulite :0 0.0.0.0 Tue Oct 25 10:47 - 10:47 (00:00) The 0.0.0.0 login always lasts for 00:00, I also have no idea on what is happening but i think that it might be related to the way the X server works (i tested on another desktop running another display manager and GUI with similar results as well). Maybe someone knows what is going on Regards, Manulite Tadej wrote: | Hi! | | Just out of curiosity I ran "last -i" on my debian sarge and it came out | with an interesting output: | | $ last -i | tadej pts/7 0.0.0.0 Wed Oct 26 13:33 still logged | in | tadej pts/6 0.0.0.0 Mon Oct 24 08:35 - 13:33 (2 | +04:58) | tadej pts/5 0.0.0.0 Mon Oct 24 08:35 still logged | in | tadej pts/4 0.0.0.0 Mon Oct 24 08:35 still logged | in | tadej pts/3 0.0.0.0 Mon Oct 24 08:35 still logged | in | tadej pts/2 0.0.0.0 Mon Oct 24 08:35 still logged | in | tadej pts/1 0.0.0.0 Mon Oct 24 08:35 still logged | in | tadej pts/0 0.0.0.0 Mon Oct 24 08:20 still logged | in | tadej :0 18.205.3.64 Mon Oct 24 08:19 still logged | in | reboot system boot 0.0.0.0 Mon Oct 24 08:19 (3 | +03:03) | root tty3 0.0.0.0 Fri Oct 21 16:19 - 16:19 (00:00) | tadej pts/7 0.0.0.0 Thu Oct 20 08:54 - 09:18 (00:24) | tadej pts/8 0.0.0.0 Mon Oct 17 09:54 - 11:00 (01:05) | tadej pts/8 0.0.0.0 Mon Oct 17 09:43 - 09:44 (00:01) | tadej pts/6 0.0.0.0 Mon Oct 17 08:28 - down (4 | +07:52) | tadej pts/5 0.0.0.0 Mon Oct 17 08:28 - down (4 | +07:52) | tadej pts/4 0.0.0.0 Mon Oct 17 08:28 - down (4 | +07:52) | tadej pts/3 0.0.0.0 Mon Oct 17 08:28 - down (4 | +07:52) | tadej pts/2 0.0.0.0 Mon Oct 17 08:28 - down (4 | +07:52) | tadej pts/1 0.0.0.0 Mon Oct 17 08:28 - down (4 | +07:52) | tadej pts/0 0.0.0.0 Mon Oct 17 08:28 - down (4 | +07:52) | tadej :0 18.205.3.64 Mon Oct 17 08:27 - down (4 | +07:53) | reboot system boot 0.0.0.0 Mon Oct 17 08:27 (4 | +07:53) | | | Strange, somebody from 18.205.3.64 logged on my system? And I don't run | any server program (at least not accesible from outside my firewall). | And as I understand :0 stands for local login? | | | $ who -a | Oct 24 08:19 369 id=si term=0 | exit=0 | system boot Oct 24 08:19 | run-level 2 Oct 24 08:19 last=S | Oct 24 08:19 4033 id=l2 term=0 | exit=0 | LOGIN tty1 Oct 24 08:19 4404 id=1 | LOGIN tty2 Oct 24 08:19 4406 id=2 | LOGIN tty3 Oct 24 08:19 4407 id=3 | LOGIN tty4 Oct 24 08:19 4408 id=4 | LOGIN tty5 Oct 24 08:19 4410 id=5 | LOGIN tty6 Oct 24 08:19 4434 id=6 | tadej ? :0 Oct 24 08:19 ? 4629 | tadej + pts/0 Oct 24 08:20 21:16 4725 (:0.0) | tadej + pts/1 Oct 24 08:35 00:06 4725 (:0.0) | tadej + pts/2 Oct 24 08:35 00:12 4725 (:0.0) | tadej + pts/3 Oct 24 08:35 00:06 4725 (:0.0) | tadej + pts/4 Oct 24 08:35 staro 4725 (:0.0) | tadej + pts/5 Oct 24 08:35 00:14 4725 (:0.0) | pts/6 Oct 26 13:33 0 id=/6 term=0 | exit=0 | tadej + pts/7 Oct 26 13:33 . 4725 (:0.0) | | $ ps p4629 | PID TTY STAT TIME COMMAND | 4629 ? Ss 0:08 /usr/bin/gnome-session | | | | There's no DNS for 18.205.3.64 and it belongs to MIT: | | NetRange: 18.0.0.0 - 18.255.255.255 | CIDR: 18.0.0.0/8 | NetName: MIT | NetHandle: NET-18-0-0-0-1 | | | And no record of 18.205.3.64 in any log, no netflow data from or to this | IP, google has no record of it. | | Anybody have any idea how and where it came from? | | | Regards, Tadej | | _______________________________________________ | gnome-list mailing list | gnome-list@xxxxxxxxx | http://mail.gnome.org/mailman/listinfo/gnome-list -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFDYOFdeysSbU7xlhURAmBQAJ4tpqWi2PRNgG4bChmBOkITJxvQjgCfb2MU XsVmtZCjeQJlnWI49/vsUSo= =7xIX -----END PGP SIGNATURE----- _______________________________________________ gnome-list mailing list gnome-list@xxxxxxxxx http://mail.gnome.org/mailman/listinfo/gnome-list
