On Wednesday 29 Jan 2003 4:08 pm, Kaj Haulrich wrote: > On Wednesday 29 January 2003 02:51 pm, Derek Jennings > > wrote: > > On Wednesday 29 Jan 2003 3:28 pm, Kaj Haulrich wrote: > > > When running dmesg I suddenly get a lot of the > > > following stanzas at the end of the output : > > > > > > <quote> > > > Shorewall:net2all:DROP:IN=eth0 OUT= > > > MAC=00:50:ba:c6:65:6a:00:08:a4:cb:f0:38:08:00 > > > SRC=80.196.168.193 > > > DST=80.198.61.245 LEN=60 TOS=0x00 PREC=0x00 TTL=58 > > > ID=23128 DF PROTO=TCP SPT=1457 DPT=443 > > > WINDOW=5840 RES=0x00 SYN URGP=0 > > > > > > Shorewall:net2all:DROP:IN=eth0 OUT= > > > MAC=00:50:ba:c6:65:6a:00:08:a4:cb:f0:38:08:00 > > > SRC=80.196.168.193 > > > DST=80.198.61.245 LEN=60 TOS=0x00 PREC=0x00 TTL=58 > > > ID=23129 DF PROTO=TCP SPT=1457 DPT=443 > > > WINDOW=5840 RES=0x00 SYN URGP=0 > > > </quote> > > > > > > I guess it's Shorewall reporting IP-addresses trying > > > to *slam* me - to no avail. > > > > > > Correct ? > > > > > > Kaj Haulrich. > > > > No. The destination port is 443 which is https > > Slammer will hit on port 1434. > > > > My log is full up with those :( > > > > derek > > Then what is it, Derek ? And what is port 443 for ? > > Kaj Haulrich.
Like I said. It is https (Secure web page) Could be someone looking for sites who have not updated their ssh after that security bug that came out a while back. derek -- ---------------------------------- www.jennings.homelinux.net
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
