Congrats on the interview and best of luck with that ;) As for your question, that sounds like failed passive FTP negotiation. It could also be backscatter from someone using the network you belong to as a decoy while DDoS'ing a remote site. Do you have a packet capture of the traffic?
--Ryan On Mon, Jan 05, 2004 at 06:29:28AM -0800, Ted Kat. wrote: > Hi List! > > After months of waiting I finally have a job interview! Thought I > might > throw that out there, Its a huge milestone for this nerd. > > Well, on with the show. I have been bombarded by a bunch of Ip's > lately. Thanks to Iptables/netfilter most go unanswered :). But my big > problem is that of the 599 ips to hit me these last 5 days half are > trying to connect to my machine w/o syn packet set. It looks like the > source port of these ips jump from 21 up to 35771. I just want to > identify > what this little attack is all about. > > Any thoughts? > > > > ===== > Ted Katseres > > ------------------------------------------------ > ------ C , C++, Java or Cobol ------- > ------ Linux doesn't care ------------- > ------------------------------------------------ > > __________________________________ > Do you Yahoo!? > Find out what made the Top Yahoo! Searches of 2003 > http://search.yahoo.com/top2003
