I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message:

kernel: v0 neigfradn tt
kernel: [2108296.63083] devc nt nee rmcosmd
kernel: [2110073.035288] host ignores redirects or 12181214t neigfradn tt
kernel: dr12181214t<>[21185727]vrr:pr (nt)etrn owrigsae<>2185749]vrr:pr (nt)etrn ialdsae<>2185745]dvc nt etpoicosmd
kernel: 6[118.864 ib0 ot1ve0 neigdsbe tt
kernel: 618.602 eieve0etrdpoicosmd

Anyone have a clue what this could be related to?

  • 1
    Two things to look at: 1) read the log with hexdump or equivalent to check for hidden control codes that could be messing up your view, and 2) make sure your system logger isn't listening for messages on the public internet -- someone could be fuzzing it.
    – Mark
    Jun 25, 2014 at 8:30
  • Or the logs got corrupted ...
    – schroeder
    Jun 25, 2014 at 20:32
  • @Mark How could I test if one is fuzzing? Jun 25, 2014 at 22:14
  • Turns out this is lxc and kvm borking on itself on the bridge device over the lack of checksums being emitted on the virtual nic and some cross talk with the cisco router our DC is running. Jul 5, 2014 at 23:48


You must log in to answer this question.

Browse other questions tagged .