Re: suspicious smbd connections

2003-12-24 Thread outsider
Noah L. Meyerhans wrote: On Tue, Dec 23, 2003 at 07:01:01PM +0100, outsider wrote: Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What are these connections? Is somebody trying to scan me or what is the reason for

Re: suspicious smbd connections

2003-12-24 Thread Noah L. Meyerhans
On Wed, Dec 24, 2003 at 03:33:54PM +0100, outsider wrote: But I have a dynamic IP. Every time I boot my system I get another IP-address. The worms are targetting random IP addresses. The IP address you have tomorrow is just as likely to get scanned as the one you have today. (Technically not

Re: suspicious smbd connections

2003-12-24 Thread Jose Luis Domingo Lopez
On Wednesday, 24 December 2003, at 15:33:54 +0100, outsider wrote: But I have a dynamic IP. Every time I boot my system I get another IP-address. There is no end of viruses, worms, and people with too much free time and too little brain under their hulls out there. So having a dynamic IP

Re: suspicious smbd connections

2003-12-24 Thread Christian Storch
That's typical: IP's are really scanned like ..., 1.2.3.4, 1.2.3.5, 1.2.3.6, ... etc. You are being scanned. Get used to it. You're not specifically being targetted, but rather your IP address was randomly generated by some worm on some Windows box and a connection attempt was made. If

Re: suspicious smbd connections

2003-12-24 Thread Dale Amon
On Wed, Dec 24, 2003 at 03:33:54PM +0100, outsider wrote: But I have a dynamic IP. Every time I boot my system I get another IP-address. Besides what everyone else said... I've also seen it happen that someone pulls an address from dhcp that was perhaps minutes before being used by someone

Re: suspicious smbd connections

2003-12-24 Thread Alvin Oga
On Wed, 24 Dec 2003, Jose Luis Domingo Lopez wrote: On Wednesday, 24 December 2003, at 15:33:54 +0100, outsider wrote: But I have a dynamic IP. Every time I boot my system I get another IP-address. There is no end of viruses, worms, and people with too much free time and too

Re: suspicious smbd connections

2003-12-24 Thread outsider
Noah L. Meyerhans wrote: On Tue, Dec 23, 2003 at 07:01:01PM +0100, outsider wrote: Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What are these connections? Is somebody trying to scan me or what is the reason

Re: suspicious smbd connections

2003-12-24 Thread Noah L. Meyerhans
On Wed, Dec 24, 2003 at 03:33:54PM +0100, outsider wrote: But I have a dynamic IP. Every time I boot my system I get another IP-address. The worms are targetting random IP addresses. The IP address you have tomorrow is just as likely to get scanned as the one you have today. (Technically not

Re: suspicious smbd connections

2003-12-24 Thread Christian Storch
That's typical: IP's are really scanned like ..., 1.2.3.4, 1.2.3.5, 1.2.3.6, ... etc. You are being scanned. Get used to it. You're not specifically being targetted, but rather your IP address was randomly generated by some worm on some Windows box and a connection attempt was made. If

Re: suspicious smbd connections

2003-12-24 Thread Jose Luis Domingo Lopez
On Wednesday, 24 December 2003, at 15:33:54 +0100, outsider wrote: But I have a dynamic IP. Every time I boot my system I get another IP-address. There is no end of viruses, worms, and people with too much free time and too little brain under their hulls out there. So having a dynamic IP

Re: suspicious smbd connections

2003-12-24 Thread Dale Amon
On Wed, Dec 24, 2003 at 03:33:54PM +0100, outsider wrote: But I have a dynamic IP. Every time I boot my system I get another IP-address. Besides what everyone else said... I've also seen it happen that someone pulls an address from dhcp that was perhaps minutes before being used by someone

Re: suspicious smbd connections

2003-12-24 Thread Alvin Oga
On Wed, 24 Dec 2003, Jose Luis Domingo Lopez wrote: On Wednesday, 24 December 2003, at 15:33:54 +0100, outsider wrote: But I have a dynamic IP. Every time I boot my system I get another IP-address. There is no end of viruses, worms, and people with too much free time and too

suspicious smbd connections

2003-12-23 Thread outsider
Hi, Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What are these connections? Is somebody trying to scan me or what is the reason for these messages? Thank you in advance! -- To UNSUBSCRIBE, email to [EMAIL

Re: suspicious smbd connections

2003-12-23 Thread Noah L. Meyerhans
On Tue, Dec 23, 2003 at 07:01:01PM +0100, outsider wrote: Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What are these connections? Is somebody trying to scan me or what is the reason for these messages? You

Re: suspicious smbd connections

2003-12-23 Thread Phillip Hofmeister
You may wish to enable an iptables filter to block all ports except those you explicitly allow. On Tue, 23 Dec 2003 at 01:01:01PM -0500, outsider wrote: Hi, Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What

suspicious smbd connections

2003-12-23 Thread outsider
Hi, Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What are these connections? Is somebody trying to scan me or what is the reason for these messages? Thank you in advance!

Re: suspicious smbd connections

2003-12-23 Thread Noah L. Meyerhans
On Tue, Dec 23, 2003 at 07:01:01PM +0100, outsider wrote: Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What are these connections? Is somebody trying to scan me or what is the reason for these messages? You

Re: suspicious smbd connections

2003-12-23 Thread Phillip Hofmeister
You may wish to enable an iptables filter to block all ports except those you explicitly allow. On Tue, 23 Dec 2003 at 01:01:01PM -0500, outsider wrote: Hi, Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What