/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Arturo - Lists <[EMAIL PROTECTED]> wrote:
>
> Jan 18 16:16:56 lnx kernel: Packet log: input REJECT eth0 PROTO=6
> 208.49.251.197:3965 255.255.255.255:23 L=60 S=0x00 I=33313 F=0x4000
> T=55
> Jan 18 16:16:56 lnx kernel: Packet log: input REJECT eth0 PROTO=6
> 208.49.251.197:3967 my.ip.add.ress:23 L=60 S=0x00 I=33315 F=0x4000
> T=55
These appear to be attempts to hack into your system.
> I get about a dozen like those a day from different ip adds to
> different ports; 0,21,139,8080,60000, etc.
Yes, those are common ports to scan for services. If you are rejecting
these connections, then you are resisting the attack. If they always
come from the same IP address, then you should report the activity to
the owner of that IP address. You can find the owner via "Whois":
whois [EMAIL PROTECTED]
Beware that IP addresses are often spoofed, or sometimes redirected from
the actual source of the attack. Don't assume that the IP you see is
the true source of the attack. Don't word your E-mail in a hostile
manner towards the network owner; they may not be the ones directly
responsible.
> Also, why on the first entry the destination is 255.255.255.255:23 ?
That is a broadcast IP; it goes to everyone that the routers will pass
it to, which apparently includes you.
> Should I worry? Any comments?
Worry a little bit. If it becomes annoying, send some E-mail to the
ISP's involved, and ask them what's going on. These sorts of attacks
are becoming more and more commonplace on the Hostile Internet of today.
--
[EMAIL PROTECTED] (Fuzzy Fox) || "Good judgment comes from experience.
sometimes known as David DeSimone || Experience comes from bad judgment."
http://www.dallas.net/~fox/ || -- Life Lessons
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
