I'm wondering about about the big time stamps of the ip address 121.130.59.25:
$ cat /proc/net/xt_recent/MAX_CONN_PER_IP
src=92.53.20.66 ttl: 122 last_seen: 743433 oldest_pkt: 2 740470, 743433
src=216.172.178.24 ttl: 53 last_seen: 714346 oldest_pkt: 1 714346
src=121.130.59.25 ttl: 113 last_seen: 4294768081 oldest_pkt: 1 4294768081
src=2.90.50.179 ttl: 110 last_seen: 257432 oldest_pkt: 1 257432
src=92.224.122.219 ttl: 64 last_seen: 175404 oldest_pkt: 1 175404
The background is that I use this perl 1-liner to convert the times into readable local time strings :
$> perl -wane 'foreach my $i (4..$#F) {$r = \$F[$i]; next unless ($$r); $$r =~ s/,//g; next unless ($$r =~ m/\d+$/); next unless ($$r > 100000); $$r = localtime (time() - $$r/1000); } print join (" ", @F), "\n"'
/proc/net/xt_recent/MAX_CONN_PER_IP
and getting this output:
src=92.53.20.66 ttl: 122 last_seen: Tue Apr 10 20:01:22 2012 oldest_pkt: 2 Tue Apr 10 20:01:25 2012 Tue Apr 10 20:01:22 2012
src=216.172.178.24 ttl: 53 last_seen: Tue Apr 10 20:01:51 2012 oldest_pkt: 1 Tue Apr 10 20:01:51 2012
src=121.130.59.25 ttl: 113 last_seen: Tue Feb 21 02:14:17 2012 oldest_pkt: 1 Tue Feb 21 02:14:17 2012
src=2.90.50.179 ttl: 110 last_seen: Tue Apr 10 20:09:28 2012 oldest_pkt: 1 Tue Apr 10 20:09:28 2012
src=92.224.122.219 ttl: 64 last_seen: Tue Apr 10 20:10:50 2012 oldest_pkt: 1 Tue Apr 10 20:10:50 2012
and I do know that the dates from February can't be correct due to an uptime of less than 1 day.
--
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
