Bugtraq: Re: [LINUX] IP_MASQ / Ethernet Passing Traffic After Halt

[alan () LXORGUK UKUU ORG UK (Alan Cox)]

>  the IP Masquerade gateway to an external host and the Ethernet interfaces
>  inside the machine are still being supplied power, that connection will
>  stay online in a fully interactive state.
Actually this is a feature. You can reboot a machine and not lose most
masqueraded connections. The Linux halt halts userspace. If you want to
down the network interfaces stick it in the rc files.

I'd suggest people under attack pull out cables anyway - you don't know
what your compromised machine is also doing or if "halt" is now a member of
rootkit.

Alan