OTUC connection with OXE

[prasad0777]

hi ...

Please note that for some reason we shutdown our OTUC server last week. But when I check the log file for OXE it shows IP address of OTUC is still sending some inquiry or something. does anyone has any idea about following log.

OTUC IP is : 192.168.180.5 The OXE IP is : 192.168.180.12

Dec 7 14:56:36 xa001001 PAM_unix[8120]: (system-auth) session closed for user mtcl
Dec 7 14:57:59 xa001001 xinetd[723]: START: ftp pid=8606 from=192.168.180.5
Dec 7 14:58:00 xa001001 xinetd[723]: EXIT: ftp pid=8606 duration=1(sec)
Dec 7 14:58:05 xa001001 xinetd[723]: START: ftp pid=8610 from=192.168.180.5
Dec 7 14:58:05 xa001001 xinetd[723]: EXIT: ftp pid=8610 duration=0(sec)
Dec 7 14:58:44 xa001001 xinetd[723]: START: ftp pid=8626 from=192.168.180.5
Dec 7 14:58:46 xa001001 xinetd[723]: EXIT: ftp pid=8626 duration=2(sec)
Dec 7 15:00:00 xa001001 xinetd[723]: START: shell pid=8653 from=192.168.180.12
Dec 7 15:00:00 xa001001 pam_rhosts_auth[8653]: allowed to mtcl@xb001001 as mtcl
Dec 7 15:00:00 xa001001 PAM_unix[8653]: (system-auth) session opened for user mtcl by (uid=0)
Dec 7 15:00:01 xa001001 xinetd[723]: START: shell pid=8680 from=192.168.180.12
Dec 7 15:00:01 xa001001 pam_rhosts_auth[8680]: allowed to mtcl@xb001001 as mtcl
Dec 7 15:00:01 xa001001 PAM_unix[8680]: (system-auth) session opened for user mtcl by (uid=0)

[cavagnaro]

If the server is down and no OS running therefore how can it send some network package? Check the MAC from where that request is coming and try to follow that.

[prasad0777]

Dear cavagnaro,

Yes ... and for your information we notice that someone has hack into our system recently. That's why we are worry about all the logs. BTW assume that OTUC is on, do you have any idea what does this logs mean ? is it trying connect to the OXE as normal behavior or something unusual ? we have open a SR for this as well, but I think here I might get more detail information as always.