Original Message:
Sent: 10-29-2024 15:57
From: JOHN WILLIAMSON
Subject: rcp command shows very frequently in messages log. Is this from inside ?
Bingo!
show route table __juniper_private4__.inet.0
__juniper_private4__.inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
192.168.1.0/24 *[Direct/0] 37w0d 23:21:57
> via em2.32768
192.168.1.2/32 *[Local/0] 37w0d 23:21:57
Local via em2.32768
So, how do I figure out what "device" in the QFX switch is filling my log with events?
------------------------------
JOHN WILLIAMSON
Original Message:
Sent: 10-29-2024 15:38
From: Jibu Thomas
Subject: rcp command shows very frequently in messages log. Is this from inside ?
No, I meant its an internal ip address within the box. On some of the platform junos runs on top of linux as a VM. So the connectivity between vJUNOS and linux host is via this internal network.
------------------------------
Jibu Thomas
Original Message:
Sent: 10-29-2024 15:24
From: JOHN WILLIAMSON
Subject: rcp command shows very frequently in messages log. Is this from inside ?
I don't have that scope. We just have 192.168.100.0/24
------------------------------
JOHN WILLIAMSON
Original Message:
Sent: 10-29-2024 15:14
From: Jibu Thomas
Subject: rcp command shows very frequently in messages log. Is this from inside ?
This looks to be internal ip address . Its the connectivity from vJunos to linux host.
show route table __juniper_private4__.inet.0
__juniper_private4__.inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
192.168.1.0/24 *[Direct/0] 1w6d 13:13:46
> via em2.32768
192.168.1.2/32 *[Local/0] 1w6d 13:13:46
Local via em2.32768
------------------------------
Jibu Thomas
Original Message:
Sent: 10-29-2024 12:45
From: JOHN WILLIAMSON
Subject: rcp command shows very frequently in messages log. Is this from inside ?
I pulled up the messages log on our core switch to troubleshoot another issue and I saw a lot of this:
rshd[32952]: root@192.168.1.16 as root: cmd='rcp -d -t /var/log/'
I haven't found a route to that IP range or a known server on our campus. I haven't found what the -d and -t parts do yet either. All the MAN pages I have found don't list them.
I'm trying to figure out what would need to transfer info to or from a log file.
------------------------------
JOHN WILLIAMSON
------------------------------