>
> Does anybody know of a hack against Samba that is making the rounds and
> anything else that likes to send a lot of packets to port 137 - regardless
> of whether a connection was estblished or not ?
>
> My sites are being hit by a constant barrage of packets for port 137 - all
> of which are being blocked by the firewall, but the number of them is
> disconcerting.
>
CC for me too. My entire class C is being scanned every few days
Sequential IP addresses for the entire block
I like you have begun to think there is some new killer hack for MS hosts
that they are looking for in the SMB.
Ian.
EG:
Apr 9 10:03:38 chevy kernel: Packet log: ppp-in DENY ppp0 PROTO=17
24.0.166.34:137 203.55.82.1:137 L=78 S=0x00 I=12925 F=0x0000 T=115 (#33)
Apr 9 10:03:47 chevy kernel: Packet log: ppp-in DENY ppp0 PROTO=17
24.0.166.34:137 203.55.82.2:137 L=78 S=0x00 I=14461 F=0x0000 T=115 (#33)
Apr 9 10:03:48 chevy kernel: Packet log: ppp-in DENY ppp0 PROTO=17
24.0.166.34:137 203.55.82.2:137 L=78 S=0x00 I=14717 F=0x0000 T=115 (#33)
Apr 9 10:03:50 chevy kernel: Packet log: ppp-in DENY ppp0 PROTO=17
24.0.166.34:137 203.55.82.2:137 L=78 S=0x00 I=14973 F=0x0000 T=115 (#33)
Apr 9 10:03:56 chevy kernel: Packet log: ppp-in DENY ppp0 PROTO=17
24.0.166.34:137 203.55.82.3:137 L=78 S=0x00 I=15997 F=0x0000 T=115 (#33)
Apr 9 10:03:57 chevy kernel: Packet log: ppp-in DENY ppp0 PROTO=17
24.0.166.34:137 203.55.82.3:137 L=78 S=0x00 I=16253 F=0x0000 T=115 (#33)
Apr 9 10:03:59 chevy kernel: Packet log: ppp-in DENY ppp0 PROTO=17
24.0.166.34:137 203.55.82.3:137 L=78 S=0x00 I=16509 F=0x0000 T=115 (#33)
Apr 9 10:04:05 chevy kernel: Packet log: ppp-in DENY ppp0 PROTO=17
24.0.166.34:137 203.55.82.4:137 L=78 S=0x00 I=17533 F=0x0000 T=115 (#33)
Apr 9 10:04:07 chevy kernel: Packet log: ppp-in DENY ppp0 PROTO=17
24.0.166.34:137 203.55.82.4:137 L=78 S=0x00 I=17789 F=0x0000 T=115 (#33)
Apr 9 10:04:08 chevy kernel: Packet log: ppp-in DENY ppp0 PROTO=17
24.0.166.34:137 203.55.82.4:137 L=78 S=0x00 I=18045 F=0x0000 T=115 (#33)
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
