Koozali.org: home of the SME Server

Was I hacked?

Offline calisun

  • *
  • 620
  • +0/-1
Was I hacked?
« on: July 29, 2006, 12:42:44 PM »
While going through my message logs I have found an entry that I don't really understand. Was I hacked or not?

Jul 24 21:02:30 smeserver dhclient: DHCPREQUEST on eth1 to 255.255.255.255 port 67
Jul 24 21:02:30 smeserver dhclient: DHCPACK from 73.111.152.1
Jul 24 21:02:30 smeserver rc.e-smith: Starting ippp:  succeeded
SME user and community member since 2005.
Want to install Wordpress in iBay of SME Server?
See my step-by-step How-To wiki here:
http://wiki.contribs.org/Wordpress_Multisite

Offline ldkeen

  • *
  • 405
  • +0/-0
Was I hacked?
« Reply #1 on: July 30, 2006, 08:09:27 AM »
Well, I might be wrong but it looks to me like you have a dynamic IP address with your ISP and your sme server requested a new lease via eth1. In any case you really shouldn't be asking security related questions on public forums - send your requests to securityATcontribs.org.
Lloyd

Offline edtest

  • *
  • 9
  • +0/-0
Was I hacked?
« Reply #2 on: July 31, 2006, 01:19:54 PM »
That's not a hack, it's a DHCP ACK - an address was offered by the DHCP server and acknowledged by your server.

Offline calisun

  • *
  • 620
  • +0/-1
Was I hacked?
« Reply #3 on: August 02, 2006, 06:59:04 PM »
yes, I have dynamic IP, but the IP address shown is not the IP address of my server.
SME user and community member since 2005.
Want to install Wordpress in iBay of SME Server?
See my step-by-step How-To wiki here:
http://wiki.contribs.org/Wordpress_Multisite

Offline CharlieBrady

  • *
  • 6,918
  • +3/-0
Was I hacked?
« Reply #4 on: August 02, 2006, 08:44:11 PM »
Quote from: "calisun"
yes, I have dynamic IP, but the IP address shown is not the IP address of my server.


No, it's the IP address of the DHCP server at your ISP. That's what "from" means.