I agree with Chris , though it could be someone scanning for anonymous ftp
servers , is it one ip? multiple ip addresses?
_|_ |__ ___ __ __
|_, | ) (__/_ (__) (__|
__/
On Mon, 22 Apr 2002, Chris Santerre wrote:
> This could be someone using a password cracker. Trying many logins and not
> waiting for them to finish. Doesn't sound like a port scan if it is only
> FTP.
>
> When I first read your subject, I thought you were talking about an old
> trick we used to play on people in college. We would place the logout
> command in their login script :) Ah, those were the days!
>
> Chris
> "Campus Computings worse nightmare"
>
> -----Original Message-----
> From: Peter Schumacher [mailto:[EMAIL PROTECTED]]
> Sent: Saturday, April 20, 2002 3:51 AM
> To: [EMAIL PROTECTED]
> Subject: ftp server: receiving quit before login is finished
>
>
> Hi,
>
> on our ftp servers I see sometimes thousands of hits which generate just
> a:
>
> "Receiving quit before login is finished"
>
> Mostly from the same or up to 3 ip addresses, it repeats normally
> within a few seconds to a minute and contiunes over days if I don't
> block the ip addresses in the firewall.
>
> Any idea which tools generate this?
>
> TIA!
> --
>
> Greetings,
> [4D-Consulting.com]eK, Wiesbaden
> Peter Schumacher
> --------------------------------------------------------
> Web: http://www.4D-Consulting.com/
> 0800-4D-Infos / 0800-43.46.367 - Fax: 0800-43.46.637
> Intl +49-611-9406.850 - Intl: +49-611-9406.744
>
