Hi all,

I found this in my logs today:

root@starchild:~# cat syslog.1
May 7 22:04:09 starchild inetd[52]: could not getpeername
May 7 22:07:38 starchild talkd[19305]: www.whatsdown.net (66.111.15.50): unintelligible packet
May 7 22:07:39 starchild talkd[19305]: www.whatsdown.net (66.111.15.50): unintelligible packet
May 7 22:08:18 starchild inetd[52]: could not getpeername
May 7 23:32:43 starchild inetd[52]: could not getpeername
May 7 23:33:24 starchild inetd[52]: could not getpeername
root@starchild:~# cat secure.1
May 6 14:51:45 starchild su[17829]: + pts/0 ron-root
May 7 22:07:38 starchild in.talkd[19305]: connect from 66.111.15.50
May 7 23:30:23 starchild su[19379]: + pts/0 ron-root

Yes, the talkd service is not running. I don't see any other questionable activity in the logs.

I'm wondering if whoever's running that site is running a linode. I'm just wondering. Then again, nodes are somewhat isolated in regards to services like talkd, no?

Again, just wondering...

The other IP isn't a Linode one, from what I can tell.

And saying that talkd wasn't running can't exactly have been true, otherwise it wouldn't have been able to enter an entry into the logs. If it doesn't show up in ps, it could be an inetd service; check either /etc/inetd.conf or /etc/xinetd.d/ depending on what you're running.

Trust me, it wasn't running. Also, before I posted, I'd already checked my /etc/inetd.conf. talkd was hashed out, but I'd already knew it was hashed out before I checked it...I checked because I wanted to be SURE that I had turned it off. In fact, that whole file is hashed out.