1

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message:

kernel: v0 neigfradn tt
kernel: [2108296.63083] devc nt nee rmcosmd
kernel: [2110073.035288] host 192.168.122.184/if4 ignores redirects or 12181214t 9.6.2.8.r1ve0 neigfradn tt
kernel: dr12181214t 9.6.2.8.<>[21185727]vrr:pr (nt)etrn owrigsae<>2185749]vrr:pr (nt)etrn ialdsae<>2185745]dvc nt etpoicosmd
kernel: 6[118.864 ib0 ot1ve0 neigdsbe tt
kernel: 618.602 eieve0etrdpoicosmd

Anyone have a clue what this could be related to?

  • 1
    Two things to look at: 1) read the log with hexdump or equivalent to check for hidden control codes that could be messing up your view, and 2) make sure your system logger isn't listening for messages on the public internet -- someone could be fuzzing it. – Mark Jun 25 '14 at 8:30
  • Or the logs got corrupted ... – schroeder Jun 25 '14 at 20:32
  • @Mark How could I test if one is fuzzing? – Dwight Spencer Jun 25 '14 at 22:14
  • Turns out this is lxc and kvm borking on itself on the bridge device over the lack of checksums being emitted on the virtual nic and some cross talk with the cisco router our DC is running. – Dwight Spencer Jul 5 '14 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.