source address 127.0.0.1 - very strange

[bilfast]

I'm on adsl and getting spoofed packets of very regular pattern at very regular time intervals.

the source address is 127.0.0.1
has anybody seen that before ?

http://bbs.adslguide.org.uk/showthreaded.php?Cat=&Board=security&Number=1173702

details are on adslguide forum, above link

 

[bjverzal]

Run Ethereal and/or netstat -an

Look at source and destination IP addresses in Ethereal. See what interface they are coming from.

BV

 

[glacierxx]

127.0.0.1 is you

"evil prospers when good men do nothing”

 

[FaiTHLeSS]

Are you infected with anything ? Have you tried doing a virus scan.

http://housecall.trendmicro.com

Online scanner.

 

[bilfast]

I've got a dsl router forwarding all traffic to my linux box. even when the linux box is not on the network, the traffic with source address 127.0.0.1 can be seen by another packet sniffing computer.

all invalid traffic like this is blocked by linux box.

i've never thought about a virus though, it could be one of the windows 98 machines i've got. i'll take it down and see if this traffic is still there.

thanks everybody !