Re: Possible Attack?

2005-06-21 Thread Dan Nelson
In the last episode (Jun 21), Troy G. said: > I was going through a few servers tonight and came across this in > /var/log/messages. This particular server functions mainly as our > primary webserver. Its running FreeBSD 4.8-RELEASE. I decided to > take a closer look to see what was generating t

Re: Possible Attack?

2005-06-21 Thread Olivier Nicole
> Jun 21 21:50:55 mx1 /kernel: Limiting closed port RST response from 230 > to 200 packets per second > Jun 21 21:51:23 mx1 /kernel: Limiting closed port RST response from 222 > to 200 packets per second > Jun 21 21:53:02 mx1 /kernel: Limiting closed port RST response from 230 > to 200 packets p

Possible Attack?

2005-06-21 Thread Troy G.
Hi all, I was going through a few servers tonight and came across this in /var/log/messages. This particular server functions mainly as our primary webserver. Its running FreeBSD 4.8-RELEASE. I decided to take a closer look to see what was generating these entries by loading up trafshow.

Re: Possible attack?

2003-01-18 Thread Paul Everlund
Alex wrote: Dear/Beste Bill, Friday, January 17, 2003, 4:01:43 PM, you wrote: > I've seen the "anonymous FTP denied" off and on. I think that > > some folks just randomly attempt to connect to any FTP server > > they find in the hopes that there's cool stuff there. Or in the hopes that the c

Re[2]: Possible attack?

2003-01-18 Thread Alex
Dear/Beste Bill, Friday, January 17, 2003, 4:01:43 PM, you wrote: > I've seen the "anonymous FTP denied" off and on. I think that some folks > just randomly attempt to connect to any FTP server they find in the > hopes that there's cool stuff there. Or in the hopes that the can place some cool

Re: Possible attack?

2003-01-17 Thread Jim Freeze
ME > > Content-Disposition header due to > > field size (length = 25) (possible attack) > > Jan 15 17:33:04 rabbit ftpd[4435]: ANONYMOUS FTP LOGIN REFUSED FROM > > pD9E60C0F.dip.t-dialin.net > > Jan 15 23:59:48 rabbit sm-mta[5210]: h0G4xkJI005209: Truncated MIME

Re: Possible attack?

2003-01-17 Thread Bill Moran
[1503]: ANONYMOUS FTP LOGIN REFUSED FROM p5089A961.dip.t-dialin.net Jan 15 12:15:21 rabbit sm-mta[3937]: h0FHFIJI003936: Truncated MIME Content-Disposition header due to field size (length = 25) (possible attack) Jan 15 17:33:03 rabbit ftpd[4434]: ANONYMOUS FTP LOGIN REFUSED FROM

Re: Possible attack?

2003-01-17 Thread Axel Gruner
14 17:39:13 rabbit ftpd[1503]: ANONYMOUS FTP LOGIN REFUSED FROM > > p5089A961.dip.t-dialin.net > > Jan 15 12:15:21 rabbit sm-mta[3937]: h0FHFIJI003936: Truncated MIME > > Content-Disposition header due to > > field size (length = 25) (possible attack) > > Jan 15 1

RE: Possible attack?

2003-01-17 Thread JoeB
2003 9:35 AM To: FreeBSD Questions Subject: Possible attack? Hi: I got an interesting log report today. Has anyone seen such messages lately? Jan 14 12:59:52 rabbit /kernel: ipfw: limit 100 reached on entry 64000 Jan 14 17:39:13 rabbit ftpd[1502]: ANONYMOUS FTP LOGIN REFUSED FROM p5089A961.d

Re: Possible attack?

2003-01-17 Thread P. U. Kruppa
M > p5089A961.dip.t-dialin.net > Jan 14 17:39:13 rabbit ftpd[1503]: ANONYMOUS FTP LOGIN REFUSED FROM > p5089A961.dip.t-dialin.net > Jan 15 12:15:21 rabbit sm-mta[3937]: h0FHFIJI003936: Truncated MIME > Content-Disposition header due to > field size (length = 25) (possible att

Possible attack?

2003-01-17 Thread Jim Freeze
FTP LOGIN REFUSED FROM p5089A961.dip.t-dialin.net Jan 15 12:15:21 rabbit sm-mta[3937]: h0FHFIJI003936: Truncated MIME Content-Disposition header due to field size (length = 25) (possible attack) Jan 15 17:33:03 rabbit ftpd[4434]: ANONYMOUS FTP LOGIN REFUSED FROM pD9E60C0F.dip.t-dialin.net Jan