Re: Possible Attack?

2005-06-21 Thread Dan Nelson
In the last episode (Jun 21), Troy G. said: > I was going through a few servers tonight and came across this in > /var/log/messages. This particular server functions mainly as our > primary webserver. Its running FreeBSD 4.8-RELEASE. I decided to > take a closer look to see what was generating t

Re: Possible Attack?

2005-06-21 Thread Olivier Nicole
> Jun 21 21:50:55 mx1 /kernel: Limiting closed port RST response from 230 > to 200 packets per second > Jun 21 21:51:23 mx1 /kernel: Limiting closed port RST response from 222 > to 200 packets per second > Jun 21 21:53:02 mx1 /kernel: Limiting closed port RST response from 230 > to 200 packets p

Re: Possible attack?

2003-01-18 Thread Paul Everlund
Alex wrote: Dear/Beste Bill, Friday, January 17, 2003, 4:01:43 PM, you wrote: > I've seen the "anonymous FTP denied" off and on. I think that > > some folks just randomly attempt to connect to any FTP server > > they find in the hopes that there's cool stuff there. Or in the hopes that the c

Re: Possible attack?

2003-01-17 Thread Jim Freeze
On Friday, 17 January 2003 at 10:01:43 -0500, Bill Moran wrote: > Jim Freeze wrote: > > Hi: > > > > I got an interesting log report today. > > Has anyone seen such messages lately? > > > > Jan 15 12:15:21 rabbit sm-mta[3937]: h0FHFIJI003936: Truncated MIME > > Content-Disposition header due to

Re: Possible attack?

2003-01-17 Thread Bill Moran
Jim Freeze wrote: Hi: I got an interesting log report today. Has anyone seen such messages lately? Jan 14 12:59:52 rabbit /kernel: ipfw: limit 100 reached on entry 64000 Jan 14 17:39:13 rabbit ftpd[1502]: ANONYMOUS FTP LOGIN REFUSED FROM p5089A961.dip.t-dialin.net Jan 14 17:39:13 rabbit ftpd[

Re: Possible attack?

2003-01-17 Thread Axel Gruner
Hi. On Fri, 17 Jan 2003 15:42:10 + (GMT) [EMAIL PROTECTED] (P. U. Kruppa) wrote: > > Jan 14 12:59:52 rabbit /kernel: ipfw: limit 100 reached on entry > > 64000 Jan 14 17:39:13 rabbit ftpd[1502]: ANONYMOUS FTP LOGIN REFUSED > > FROM p5089A961.dip.t-dialin.net > > Jan 14 17:39:13 rabbit ftpd[1

RE: Possible attack?

2003-01-17 Thread JoeB
Just some body knocking at your front door. What this means is you have ports 20 & 21 open and your were port scanned. You have to add some rules to your firewall. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jim Freeze Sent: Friday, January 17, 2003 9

Re: Possible attack?

2003-01-17 Thread P. U. Kruppa
On Fri, 17 Jan 2003, Jim Freeze wrote: > Hi: > > I got an interesting log report today. > Has anyone seen such messages lately? > > Jan 14 12:59:52 rabbit /kernel: ipfw: limit 100 reached on entry 64000 > Jan 14 17:39:13 rabbit ftpd[1502]: ANONYMOUS FTP LOGIN REFUSED FROM > p5089A961.dip.t-diali