This could be someone using a password cracker. Trying many logins and not waiting for them to finish. Doesn't sound like a port scan if it is only FTP.
When I first read your subject, I thought you were talking about an old trick we used to play on people in college. We would place the logout command in their login script :) Ah, those were the days! Chris "Campus Computings worse nightmare" -----Original Message----- From: Peter Schumacher [mailto:[EMAIL PROTECTED]] Sent: Saturday, April 20, 2002 3:51 AM To: [EMAIL PROTECTED] Subject: ftp server: receiving quit before login is finished Hi, on our ftp servers I see sometimes thousands of hits which generate just a: "Receiving quit before login is finished" Mostly from the same or up to 3 ip addresses, it repeats normally within a few seconds to a minute and contiunes over days if I don't block the ip addresses in the firewall. Any idea which tools generate this? TIA! -- Greetings, [4D-Consulting.com]eK, Wiesbaden Peter Schumacher -------------------------------------------------------- Web: http://www.4D-Consulting.com/ 0800-4D-Infos / 0800-43.46.367 - Fax: 0800-43.46.637 Intl +49-611-9406.850 - Intl: +49-611-9406.744
