xauth list entries - What are these?


Subject: xauth list entries - What are these?
From: Patrick Callahan (pac1@tiac.net)
Date: Wed Nov 21 2001 - 05:48:32 MST


I did an xauth list command just before connecting to the internet using ppp
As you can see in the listing below there are four unresolved raw ip
addresses with MIT-MAGIC-COOKIE-1 entries.

After connecting, these entries appear to be resolvable as shown in the
second xauth list.

Currently none of the addresses respond to pings, and the three addresses
starting with 38.32 are not even resolvable in the current session or in
yesterday's

In a yesterday's session, I was able to ping 65.90.43.12. In the current
session the address appears to resolve, but does not respond to pings.

I'm not sure what these entries are for, or why they are there.

What configuration files, log files or other information would you look at to
get a clearer picture of what's going on with these entries. Specifically,
I'd like to find out where they're coming from. Is it something I'm doing or
is it something someone else, maybe someone with a black hat is doing?

-pat

-----------------------before starting ppp --------------------------
[pac1@ocelot pac1]$ xauth list
65.90.43.12:0 MIT-MAGIC-COOKIE-1 3b7215184279093f664d2c257c1d3909
38.32.10.212:0 MIT-MAGIC-COOKIE-1 2b6b594e1f4f25146c6e6051254a2064
38.32.90.169:0 MIT-MAGIC-COOKIE-1 34347c592a0c63303e0f485a04755746
38.32.11.219:0 MIT-MAGIC-COOKIE-1 5e314e587c562d5b253c527a781b5c1b
-f/unix:0 MIT-MAGIC-COOKIE-1 a7db0a8c2f9ec7dba178cba6c15ac78a
localhost.localdomain/unix:1 MIT-MAGIC-COOKIE-1
6d9aa56263b5c722784b21bd25a1de77
localhost.localdomain:1 MIT-MAGIC-COOKIE-1 6d9aa56263b5c722784b21bd25a1de77
localhost.localdomain/unix:0 MIT-MAGIC-COOKIE-1
5ffe1885122271e219881fd96714f83a
localhost.localdomain:0 MIT-MAGIC-COOKIE-1 5ffe1885122271e219881fd96714f83a

-----------------------after starting ppp --------------------------
[pac1@ocelot pac1]$ xauth list
p12.block2.tc1.rnktel.net:0 MIT-MAGIC-COOKIE-1
3b7215184279093f664d2c257c1d3909
ip212.bedford2.ma.pub-ip.psi.net:0 MIT-MAGIC-COOKIE-1
2b6b594e1f4f25146c6e6051254a2064
ip169.bedford16.ma.pub-ip.psi.net:0 MIT-MAGIC-COOKIE-1
34347c592a0c63303e0f485a04755746
ip219.bedford3.ma.pub-ip.psi.net:0 MIT-MAGIC-COOKIE-1
5e314e587c562d5b253c527a781b5c1b
-f/unix:0 MIT-MAGIC-COOKIE-1 a7db0a8c2f9ec7dba178cba6c15ac78a
localhost.localdomain/unix:1 MIT-MAGIC-COOKIE-1
6d9aa56263b5c722784b21bd25a1de77
localhost.localdomain:1 MIT-MAGIC-COOKIE-1 6d9aa56263b5c722784b21bd25a1de77
localhost.localdomain/unix:0 MIT-MAGIC-COOKIE-1
5ffe1885122271e219881fd96714f83a
localhost.localdomain:0 MIT-MAGIC-COOKIE-1 5ffe1885122271e219881fd96714f83a



This archive was generated by hypermail 2a24 : Wed Nov 21 2001 - 08:32:40 MST