Visit Our UNIX and Linux User Community


Message in /var/log/messages: Cannot do reverse lookup


 
Thread Tools Search this Thread
Top Forums UNIX for Dummies Questions & Answers Message in /var/log/messages: Cannot do reverse lookup
# 1  
Old 08-21-2009
Message in /var/log/messages: Cannot do reverse lookup

Hi I have an entry in hosts.deny and now I get the following message in /var/log/messages:

g 21 09:30:46 machine sshd[12441]: Failed password for illegal user d from ::ffff:213.229.69.42 port 57181 ssh2
Aug 21 09:30:46 machine sshd[12441]: Received disconnect from ::ffff:213.229.69.42: 11: Bye Bye
Aug 21 09:30:46 machine sshd[12442]: warning: /etc/hosts.deny, line 6: can't verify hostname: getaddrinfo(213-229
-69-42.static.as29550.net): Name or service not known
Aug 21 09:30:47 machine sshd[12442]: Illegal user d from ::ffff:213.229.69.42
Aug 21 09:30:47 machine sshd[12442]: input_userauth_request: illegal user d
Aug 21 09:30:47 machine sshd[12442]: reverse mapping checking getaddrinfo for 213-229-69-42.static.as29550.net fa
iled - POSSIBLE BREAKIN ATTEMPT!

Why is the box trying to do a look up for 213-229-69-442. Shouldn't it be looking for 213.229.69.442? Or are the -'s just proper syntax?
# 2  
Old 08-23-2009
The dashed address is 213-229-69-42.static.as29550.net, not 213-229-69-42. It's just the reverse lookup name the the ISP gives that address. It's pretty common practice as that way the address is right there in the name.

What it's telling you is that it can't find a matching forward and reverse DNS lookup for that name so treats it as suspicious (and is is rather suspicious).
# 3  
Old 08-24-2009
It is an IPv6 address. Looks like the DNS server may not have an ip6.arpa domain set up.
 

Previous Thread | Next Thread
Test Your Knowledge in Computers #69
Difficulty: Easy
Grep stands for 'global regular expression process'.
True or False?

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog

I have been searching and reading about syslog. I would like to know how to Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog. tail -f /var/log/messages dblogger: msg_to_dbrow: no logtype using missing dblogger: msg_to_dbrow_str: val ==... (2 Replies)
Discussion started by: kenshinhimura
2 Replies

2. Solaris

Getting continually error message in /var/adm/messages.

Hi Friends, Please help me to resove this issue ASAP. Nov 17 16:25:52 server1 sendmail: pAH8Pnh22099: SYSERR: putoutmsg (NO-HOST): error on output channel sending "553 5.1.3 @123.com.... User address required": File too large Nov 17 16:25:53 server1 sendmail: pAH8Pnh22099:... (1 Reply)
Discussion started by: holds_me
1 Replies

3. Shell Programming and Scripting

How can view log messages between two time frame from /var/log/message or any type of log files

How can view log messages between two time frame from /var/log/message or any type of log files. when logfiles are very big and especially many messages with in few minutes, I would like to display log messages between 5 minute interval. Could you pls give me the command? (1 Reply)
Discussion started by: johnveslin
1 Replies

4. Solaris

Difference between /var/log/syslog and /var/adm/messages

Hi, Is the contents in /var/log/syslog and /var/adm/messages are same?? Regards (3 Replies)
Discussion started by: vks47
3 Replies

5. UNIX for Advanced & Expert Users

/var/adm/messages vs /var/log/messages

The /var/adm/messages in Solaris seem to log more system messages/errors compared to /var/log/messages in Linux. I checked the log level in Linux and they seem OK. Is there any other log file that contains the messages or is it just that Linux doesn't log great many things? (2 Replies)
Discussion started by: gomes1333
2 Replies

6. UNIX for Dummies Questions & Answers

Message in /var/log

What does this message mean: Dec 16 04:30:01 vader kernel: target2:0:4: FAST-10 SCSI 10.0 MB/s ST (100 ns, offset 8) (2 Replies)
Discussion started by: mojoman
2 Replies

7. Solaris

diff b/w /var/log/syslog and /var/adm/messages

hi sirs can u tell the difference between /var/log/syslogs and /var/adm/messages in my working place i am having two servers. in one servers messages file is empty and syslog file is going on increasing.. and in another servers message file is going on increasing but syslog file is... (2 Replies)
Discussion started by: tv.praveenkumar
2 Replies

8. Shell Programming and Scripting

Send-file /var/log/message

Hello All i need Shell Script to send /var/log/message or another if he have or grep this file to have some info like PID or value (e.g like NFS mount - stop ) to some body in my System Thanks for Advanced (2 Replies)
Discussion started by: Hosam
2 Replies

9. UNIX for Advanced & Expert Users

Clueless about how to lookup and reverse lookup IP addresses under a file!!.pls help

Write a quick shell snippet to find all of the IPV4 IP addresses in any and all of the files under /var/lib/output/*, ignoring whatever else may be in those files. Perform a reverse lookup on each, and format the output neatly, like "IP=192.168.0.1, ... (0 Replies)
Discussion started by: choco4202002
0 Replies

10. Solaris

NRPE message in /var/adm/messages

Hi Guru's On one of our servers we have every few seconds following error: Apr 28 10:15:27 svr10010 nrpe: connect from reno.customs.govt.nz Apr 28 10:15:29 svr10010 nrpe: connect from reno.customs.govt.nz Here are the details from this box: SunOS svr10010 5.10 Generic_125100-10 sun4v... (3 Replies)
Discussion started by: gnom
3 Replies

Featured Tech Videos