Munix hacked? Valid files for install of Leopard?

[NewMacUser-TX]

but I did notice the following in my logs this morning:

Deny configd data in from 10.198.242.1:67 uid = 0 proto=17
Deny mDNSResponder data in from fe80::21f:5bff:feee:446c:5353 uid = 0 proto=17

From what I can learn from searches, this is my Mac denying my ISP from configuring my DHCP settings which should be allowed.

I also continually notice that CUPSD is "listening" on a port... why? My printer is connected directly to my MAC and I am not running a network.

[HelloMac]

Modem/Router log

(GMT)16:01:15 Tue May 15 2007 syslogd started: BusyBox v0.61.pre

(GMT)16:01:15 Tue May 15 2007 init: Waiting for enter to start '/bin/sh' (pid 86, terminal /dev/tts/0)
(GMT)16:01:16 Tue May 15 2007 logic: qos_prepare:iptables -t mangle -N EGRESS

(GMT)16:01:16 Tue May 15 2007 logic: qos_prepare:iptables -t mangle -N INGRESS

(GMT)16:01:17 Tue May 15 2007 logic: qos_prepare:iptables -t mangle -A INGRESS -j IMQ

(GMT-05:00)16:01:17 Tue May 15 2007 logic: Stunnel conf 2: TR-069 1 /var/etc/stunnel2.conf https://cpe-ems.verizon.com/cwmpWeb/CPEMgt 1 8080

(GMT-05:00)16:01:19 Tue May 15 2007 logic: dhcps starting
(GMT-05:00)16:01:24 Tue May 15 2007 udhcpd: udhcp server (v0.9.7) started

(GMT-05:00)16:01:24 Tue May 15 2007 udhcpd: ADD 00:1f:f3:52:b9:39 192.168.1.75 1000 unknownpc1

(GMT-05:00)16:01:24 Tue May 15 2007 udhcpd: ADD 00:1f:5b:b6:e8:16 192.168.1.76 1000 unknownpc1

(GMT-05:00)16:01:24 Tue May 15 2007 udhcpd: ADD 00:1e:c2:32:d5:4e 192.168.1.77 1000 unknownpc1

(GMT-05:00)16:01:24 Tue May 15 2007 udhcpd: ADD 00:1f:5b:b6:e8:16 192.168.1.78 1000 unknownpc1

(GMT-05:00)16:01:24 Tue May 15 2007 udhcpd: interface: br0, start : 4b01a8c0 end : 5001a8c0

(GMT-05:00)16:01:35 Tue May 15 2007 udhcpd: Received SIGTERM

(GMT-05:00)16:01:35 Tue May 15 2007 udhcpd: udhcp server (v0.9.7) started
(GMT-05:00)16:01:35 Tue May 15 2007 udhcpd: ADD 00:1f:f3:52:b9:39 192.168.1.75 989

unknownpc1
(
GMT-05:00)16:01:35 Tue May 15 2007 udhcpd: ADD 00:1f:5b:b6:e8:16 192.168.1.76 989 unknownpc1
(GMT-05:00)16:01:35 Tue May 15 2007 udhcpd: ADD

00:1e:c2:32:d5:4e 192.168.1.77 989 unknownpc1

(GMT-05:00)16:01:35 Tue May 15 2007 udhcpd: ADD 00:1f:5b:b6:e8:16 192.168.1.78 989 unknownpc1

(GMT-05:00)16:01:35 Tue May 15 2007 udhcpd: interface: br0, start : 4b01a8c0 end : 5001a8c0

(GMT-05:00)16:01:39 Tue May 15 2007 logic: launch stunnel 0, 0
(GMT-05:00)16:01:42 Tue May 15 2007 udhcpd: SENDING OFFER to daddy-macs-imac
(GMT-05:00)16:01:42 Tue May 15 2007 udhcpd: ADD 00:1e:52:86:be:17 192.168.1.76 60 daddy-macs-imac

(GMT-05:00)16:01:42 Tue May 15 2007 udhcpd: sending OFFER of 192.168.1.76

(GMT-05:00)16:01:42 Tue May 15 2007 udhcpd: SENDING OFFER to daddy-macs-imac

(GMT-05:00)16:01:42 Tue May 15 2007 udhcpd: ADD 00:1e:52:86:be:17 192.168.1.76 60 daddy-macs-imac

(GMT-05:00)16:01:42 Tue May 15 2007 udhcpd: sending OFFER of 192.168.1.76

(GMT-05:00)16:01:43 Tue May 15 2007 udhcpd: SENDING ACK to daddy-macs-imac

(GMT-05:00)16:01:43 Tue May 15 2007 udhcpd: sending ACK to 192.168.1.76

(GMT-05:00)16:01:43 Tue May 15 2007 udhcpd: ADD 00:1e:52:86:be:17 192.168.1.76 1000 daddy-macs-imac
(GMT-05:00)16:01:46 Tue May 15 2007 pppd[262]: Plugin

pppoe loaded.

(GMT-05:00)16:01:46 Tue May 15 2007 pppd[262]: PPPoE Plugin Initialized
(GMT-05:00)16:01:46 Tue May 15 2007 pppd[262]: Plugin pppoe called.
(GMT-05:00)16:01:46 Tue

May 15 2007 pppd[262]: pppd 2.4.1 started by DHLM, uid 0

(GMT-05:00)16:01:46 Tue May 15 2007 pppd[262]: setting line discipline hook
(GMT-05:00)16:01:46 Tue May 15 2007 pppd[262]: don't turn led red when auto-detecting
(GMT-05:00)16:01:46 Tue May 15 2007 pppd[262]: Sending PADI
(GMT-05:00)16:01:49 Tue May 15 2007 pppd[278]: Plugin pppoe loaded.

(GMT-05:00)16:01:49 Tue May 15 2007 pppd[278]: PPPoE Plugin Initialized
(GMT-05:00)16:01:49 Tue May 15 2007 pppd[278]: Plugin pppoe called.

(GMT-05:00)16:01:49 Tue May 15 2007 pppd[278]: pppd 2.4.1 started by DHLM, uid 0
(GMT-05:00)16:01:49 Tue May 15 2007 pppd[278]: setting line discipline hook
(GMT-05:00)16:01:49 Tue May 15 2007 pppd[278]: don't turn led red when auto-detecting
(GMT-05:00)16:01:49 Tue May 15 2007 pppd[278]: Sending PADI
(GMT-05:00)16:01:55 Tue May 15 2007 udhcpc: udhcp client (v0.9.7) started

(GMT-05:00)16:01:55 Tue May 15 2007 udhcpc: Sending discover...

(GMT-05:00)16:01:55 Tue May 15 2007 udhcpd: ADD 00:1f:5b:b6:e8:16 192.168.1.78 60 unknown

(GMT-05:00)16:01:55 Tue May 15 2007 udhcpd: sending OFFER of 192.168.1.78

(GMT-05:00)16:01:56 Tue May 15 2007 udhcpd: sending ACK to 192.168.1.78

(GMT-05:00)16:01:56 Tue May 15 2007 udhcpd: ADD 00:1f:5b:b6:e8:16 192.168.1.78 1000

(GMT-05:00)16:01:57 Tue May 15 2007 udhcpc: Sending discover...

(GMT-05:00)16:01:59 Tue May 15 2007 udhcpc: Sending discover...
(
GMT-05:00)16:02:01 Tue May 15 2007 pppd[306]: Plugin pppoe loaded.

(GMT-05:00)16:02:01 Tue May 15 2007 pppd[306]: PPPoE Plugin Initialized

(GMT-05:00)16:02:01 Tue May 15 2007 pppd[306]: Plugin pppoe called.

(GMT-05:00)16:02:01 Tue May 15 2007 pppd[306]: pppd 2.4.1 started by DHLM, uid 0
(
GMT-05:00)16:02:01 Tue May 15 2007 pppd[306]: setting line discipline hook

(GMT-05:00)16:02:01 Tue May 15 2007 pppd[306]: don't turn led red when auto-detecting

(GMT-05:00)16:02:01 Tue May 15 2007 pppd[306]: Sending PADI

(GMT-05:00)16:02:06 Tue May 15 2007 udhcpc: udhcp client (v0.9.7) started
(
GMT-05:00)16:02:06 Tue May 15 2007 udhcpc: Sending discover...

(GMT-05:00)16:02:07 Tue May 15 2007 udhcpd: SENDING OFFER to daddy-macs-imac

(GMT-05:00)16:02:07 Tue May 15 2007 udhcpd: ADD 00:1e:52:86:be:17 192.168.1.79 60 daddy-macs-imac

(GMT-05:00)16:02:07 Tue May 15 2007 udhcpd: sending OFFER of 192.168.1.79

(GMT-05:00)16:02:07 Tue May 15 2007 udhcpd: SENDING OFFER to daddy-macs-imac

(GMT-05:00)16:02:07 Tue May 15 2007 udhcpd: ADD 00:1e:52:86:be:17 192.168.1.79 60 daddy-macs-imac

(GMT-05:00)16:02:07 Tue May 15 2007 udhcpd: sending OFFER of 192.168.1.79

(GMT-05:00)16:02:08 Tue May 15 2007 udhcpc: Sending discover...

(GMT-05:00)16:02:08 Tue May 15 2007 udhcpd: SENDING ACK to daddy-macs-imac

(GMT-05:00)16:02:08 Tue May 15 2007 udhcpd: sending ACK to 192.168.1.79

(GMT-05:00)16:02:08 Tue May 15 2007 udhcpd: ADD 00:1e:52:86:be:17 192.168.1.79 1000 daddy-macs-imac

(GMT-05:00)16:02:08 Tue May 15 2007 logic: 00-1e-52-86-be-17/192.168.1.79 now is 192.168.1.79

(GMT-05:00)16:02:10 Tue May 15 2007 udhcpc: Sending discover...

(GMT-05:00)16:02:48 Tue May 15 2007 udhcpd: SENDING ACK to daddy-macs-imac
(
GMT-05:00)16:02:48 Tue May 15 2007 udhcpd: sending ACK to 192.168.1.79

(GMT-05:00)16:02:48 Tue May 15 2007 udhcpd: ADD 00:1e:52:86:be:17 192.168.1.79 1000 daddy-macs-imac
(
GMT-05:00)16:03:04 Tue May 15 2007 udhcpd: SENDING ACK to daddy-macs-imac

(GMT-05:00)16:03:04 Tue May 15 2007 udhcpd: sending ACK to 192.168.1.79

(GMT-05:00)16:03:04 Tue May 15 2007 udhcpd: ADD 00:1e:52:86:be:17 192.168.1.79 1000 daddy-macs-imac

(GMT-05:00)16:03:27 Tue May 15 2007 logic: fw_trans_query kp.key = report_all_clients_act0

(GMT-05:00)16:03:27 Tue May 15 2007 logic: fw_trans_query kp.key = report_all_clients_act0

(GMT-05:00)16:04:10 Tue May 15 2007 pppd[262]: HOST_UNIQ successful match

(GMT-05:00)16:04:10 Tue May 15 2007 pppd[262]: HOST_UNIQ successful match

(GMT-05:00)16:04:10 Tue May 15 2007 pppd[262]: Got connection: 1f09

(GMT-05:00)16:04:10 Tue May 15 2007 pppd[262]: Saved Session ID: 0

(GMT-05:00)16:04:10 Tue May 15 2007 pppd[262]: Connecting PPPoE socket: 00:90:1a:a0:57:82 1f09 br0 0x1000d538
(
GMT-05:00)16:04:10 Tue May 15 2007 pppd[262]: Using interface ppp0

(GMT-05:00)16:04:10 Tue May 15 2007 pppd[262]: Connect: ppp0 -> br0

(GMT-05:00)16:04:10 Tue May 15 2007 pppd[262]: MRU: 1500

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read start 192.168.1.75
(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read end 192.168.1.80

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read interface br0

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read opt router 192.168.1.1

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read opt domain dslhighway

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read opt dns 192.168.1.1 192.168.1.1 38.8.82.2

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read opt subnet 255.255.255.0

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read opt renew 20
(
GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read opt lease 1000

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read conflict_time 1000

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: read lease_file /var/tmp/landhcps0.leases

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: local IP address 72.66.59.80

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: remote IP address 10.1.48.1
(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: primary DNS address 71.252.0.12

(GMT-05:00)16:04:11 Tue May 15 2007 pppd[262]: secondary DNS address 71.242.0.12
(
GMT-05:00)16:04:11 Tue May 15 2007 syslog: config.name_server[0]=71.252.0.12

(GMT-05:00)16:04:14 Tue May 15 2007 logic: got wan ip launch stunnel

(GMT-05:00)16:04:14 Tue May 15 2007 logic: launch stunnel 1, 0
(GMT-05:00)16:04:14 Tue May 15 2007 udhcpd: Received SIGTERM

(GMT-05:00)16:04:15 Tue May 15 2007 udhcpd: udhcp server (v0.9.7) started

(GMT-05:00)16:04:15 Tue May 15 2007 udhcpd: ADD 00:1f:f3:52:b9:39 192.168.1.75 830 unknownpc1

(GMT-05:00)16:04:15 Tue May 15 2007 udhcpd: ADD 00:1e:52:86:be:17 192.168.1.76 852 daddy-macs-imac
(
GMT-05:00)16:04:15 Tue May 15 2007 udhcpd: ADD 00:1e:c2:32:d5:4e 192.168.1.77 830 unknownpc1

(GMT-05:00)16:04:15 Tue May 15 2007 udhcpd: ADD 00:1f:5b:b6:e8:16 192.168.1.78 862 unknownpc1
(
GMT-05:00)16:04:15 Tue May 15 2007 udhcpd: ADD 00:1e:52:86:be:17 192.168.1.79 930 daddy-macs-imac

(GMT-05:00)16:04:15 Tue May 15 2007 udhcpd: interface: br0, start : 4b01a8c0 end : 5001a8c0

(GMT-05:00)16:04:18 Tue May 15 2007 logic: stunnel message type 1
(
GMT-05:00)16:04:18 Tue May 15 2007 logic: stunnel report start,stunnel2,517

(GMT-05:00)16:04:20 Tue May 15 2007 logic: tr-69-client exist, do not restart it
(
GMT-05:00)23:32:56 Wed Jun 18 2008 logic: fw_trans_query kp.key = report_all_clients_act0

(GMT-05:00)23:32:57 Wed Jun 18 2008 logic: fw_trans_query kp.key = report_all_clients_act0
(
GMT-05:00)23:33:19 Wed Jun 18 2008 syslog: No response for DNS request to server 71.252.0.12 yet.

(GMT-05:00)23:33:19 Wed Jun 18 2008 pc: act_hnm not exist, restart it

(GMT-05:00)23:33:20 Wed Jun 18 2008 logic: fw_trans_query kp.key = report_all_clients_act0

(GMT-05:00)23:33:21 Wed Jun 18 2008 logic: fw_trans_query kp.key = report_all_clients_act0

(GMT-05:00)23:33:22 Wed Jun 18 2008 syslog: No response for DNS request to server 71.242.0.12 yet.

(GMT-05:00)23:33:22 Wed Jun 18 2008 syslog: All DNS servers tried, no response.
(
GMT-05:00)23:33:22 Wed Jun 18 2008 syslog: failed dns request len=71,srcip=192.168.1.1, url=79.1.168.192.in-addr.arpa

(GMT-05:00)23:34:28 Wed Jun 18 2008 syslog: No response for DNS request to server 71.252.0.12 yet.

(GMT-05:00)23:34:30 Wed Jun 18 2008 syslog: No response for DNS request to server 71.242.0.12 yet.

(GMT-05:00)23:34:30 Wed Jun 18 2008 syslog: All DNS servers tried, no response.

(GMT-05:00)23:34:30 Wed Jun 18 2008 syslog: failed dns request len=71,srcip=192.168.1.1, url=79.1.168.192.in-addr.arpa

(GMT-05:00)23:35:41 Wed Jun 18 2008 stunnel[587]: remote connect #2 (192.168.0.1:443): Connection timed out (145)

(GMT-05:00)23:35:41 Wed Jun 18 2008 stunnel[587]: Failed to initialize remote connection

[nixgeek]

No offense or anything, but at this point it seems like much ado about nothing. I don't see anything that's out of the ordinary here in this entire thread...maybe that "unknownpc" in your router log, but other than that it looks like the status quo to me.

[ElDiabloConCaca]

I also continually notice that CUPSD is "listening" on a port... why? My printer is connected directly to my MAC and I am not running a network.

CUPS manages all printers, local and networked.

CUPS also runs a website on port 631. You can access the CUPS setup page by opening a browser and pointing it to http://127.0.0.1:631 or http://localhost:631.

If you're seeing listening happening on port 631, that's why, and it's normal.

[HelloMac]

Let me more clear, when msdosfs.kext loads, nothing is happening that would require the mac to "understand" a non mac file format. No disc is inserted, no usb drive attatched, just the hard disc humming away doing it's dance with RAM.

[nixgeek]

Most every app on a Unix-based system listens to ports (you'll also find this in Windows as well). Some are local, some are not. Just type "netstat" on the command shell of any Windows or UNIX-like system and you'll see all the ports that are being used. CUPS is always listening at that port since it is a server daemon running in the background, as most other processes on Unix tend to be. Again, I still fail to see what the major problem (other than that "unknownpc" in your router log) is even after reading through this whole thread and the logs more than once.

[nixgeek]

Let me more clear, when msdosfs.kext loads, nothing is happening that would require the mac to "understand" a non mac file format. No disc is inserted, no usb drive attatched, just the hard disc humming away doing it's dance with RAM.

It's possible that the Mac is probably preconfigured to load that kernel extension on boot time. The same thing is done in any GNU/Linux or BSD system so that it can read MS-DOS filesystems right from the get go. Otherwise, you would have to MANUALLY load the kernel extension or module each time. It's just sitting there idle until it's time to be used. Again, nothing out of the norm here.

BTW, in classic Mac OS you had Control Panels and Extensions that would load on startup in order to provide you the functionality you needed once at the desktop. One of these was an extension that would allow you to mount an MS-DOS disk or volume. Sure, it would sit there idle while not being used, but it was always enabled to allow you to use it when needed....otherwise, you would not be able to access those MS-DOS volumes.

Again, I think you're making more of this than is actually the case. Though I understand your frustration, the end is not nigh.

[HelloMac]

"CUPS also runs a website on port 631. You can access the CUPS setup page by opening a browser and pointing it to http://127.0.0.1:631 or http://localhost:631.

If you're seeing listening happening on port 631, that's why, and it's normal."

Are you just messing with me? I know that's normal. But the flipside is that CUPS can be manipulated to penetrate the system. Do you drink seven or eight gallons of the kool-Aid daily?