[FUG-BR] Pergamum x novo firewall

[MArvelrat]

fiz o q tu indicou e olha ai....
ficou apenas o tal pergamum aberto na maquina....



17:18:33.627497 rule 83/0(match): pass in on rl1: 10.14.1.66.2629 > 
200.xxx.xxx.xxx                                                 1521: S 
4011464269:4011464269(0) win 16384 <mss 1460,nop,nop,sackOK>
17:19:18.520652 rule 83/0(match): pass in on rl1: 10.14.1.66.2630 > 
200.xxx.xxx.xxx                                                 1521: S 
1387155671:1387155671(0) win 16384 <mss 1460,nop,nop,sackOK>
17:19:18.759283 rule 83/0(match): pass in on rl1: 10.14.1.66.2631 > 
200.xxx.xxx.xxx.                                                1521: S 
163187944:163187944(0) win 16384 <mss 1460,nop,nop,sackOK>
17:19:21.918798 rule 83/0(match): pass in on rl1: 10.14.1.66.2632 > 
200.xxx.xxx.xxx.                                                1521: S 
2855743779:2855743779(0) win 16384 <mss 1460,nop,nop,sackOK>


17:19:34.003894 rule 84/0(match): pass in on rl1: 10.14.1.66.2636 > 
208.69.32.132.   (opendns)                               1521: S 
1703465073:1703465073(0) win 16384 <mss 1460,nop,nop,sackOK>
17:19:53.801453 rule 84/0(match): pass in on rl1: 10.14.1.66.2641 > 
208.69.32.132.                                                 1521: S 
1909327385:1909327385(0) win 16384 <mss 1460,nop,nop,sackOK>
17:20:07.940659 rule 84/0(match): pass in on rl1: 10.14.1.66.2644 > 
208.69.32.132.                                                 1521: S 
1552567099:1552567099(0) win 16384 <mss 1460,nop,nop,sackOK>


uso o OpenDns....
como vemos...as ultimas conexoes são para este ip do opendns: 
208.69.32.132... q  ao dar um traceroute nele vi que aparecia assim: 
hit-nxdomain.opendns.com [208.69.32.132]
entao pesquisei sobre o hit-nxdomain.opendns.com e li q qualquer dominio 
nao existente é linkado para hit-nxdomain.opendns.com e carrega o 
guide.opendns.com.....

/em off aki para nao sair do foco:

/(este ip 208.69.32.132 também aparece quando pingo para alguma maquina 
dentro da rede usando o nome da mesma)

ex: ping maquinadozeca
PING maquinadozeca.blabla.blabla.com.br (208.69.32.132): 56 data bytes

64 bytes from 208.69.32.132: icmp_seq=0 ttl=56 time=152.885 ms
64 bytes from 208.69.32.132: icmp_seq=1 ttl=56 time=153.239 ms
64 bytes from 208.69.32.132: icmp_seq=2 ttl=56 time=152.036 ms
64 bytes from 208.69.32.132: icmp_seq=3 ttl=56 time=152.940 ms
64 bytes from 208.69.32.132: icmp_seq=4 ttl=56 time=150.063 ms
64 bytes from 208.69.32.132: icmp_seq=5 ttl=56 time=150.749 ms
64 bytes from 208.69.32.132: icmp_seq=6 ttl=56 time=153.436 ms

é isso ae...

abraço