Re: [cobalt-users] Hacking attempts on certain port what is this used for?

[Jonathan Nichols <jnichols@xxxxxxxxxxxxxxxxx>]

SunRPC.

I got one from willow.cc.uic.edu... not sure how to contact their admins, tho..
> I keep getting different hackers trying to hack in on port 111 any one know
> at it is?
>
> Active System Attack Alerts
> =-=-=-=-=-=-=-=-=-=-=-=-=-=
> Feb 18 16:30:03 www portsentry[724]: attackalert: Connect from host:
> edda.fis.cinvestav.mx/148.247.8.20 to TCP port: 111
> Feb 18 16:30:03 www portsentry[724]: attackalert: Host 148.247.8.20 has been
> blocked via wrappers with string: "ALL: 148.247.8.20"
> Feb 18 16:30:03 www portsentry[724]: attackalert: Host 148.247.8.20 has been
> blocked via dropped route using command: "/sbin/route add -host 148.247.8.20
> gw 127.0.0.1"
> Feb 18 16:30:03 www portsentry[724]: attackalert: Connect from host:
> edda.fis.cinvestav.mx/148.247.8.20 to TCP port: 111
> Feb 18 16:30:03 www portsentry[724]: attackalert: Host: 148.247.8.20 is
> already blocked. Ignoring
> Feb 18 16:30:03 www portsentry[724]: attackalert: Connect from host:
> edda.fis.cinvestav.mx/148.247.8.20 to TCP port: 111
> Feb 18 16:30:03 www portsentry[724]: attackalert: Host: 148.247.8.20 is
> already blocked. Ignoring
> Feb 18 16:30:03 www portsentry[724]: attackalert: Connect from host:
> edda.fis.cinvestav.mx/148.247.8.20 to TCP port: 111
> Feb 18 16:30:03 www portsentry[724]: attackalert: Host: 148.247.8.20 is
> already blocked. Ignoring
> Feb 18 16:30:03 www portsentry[724]: attackalert: Connect from host:
> edda.fis.cinvestav.mx/148.247.8.20 to TCP port: 111
> Feb 18 16:30:03 www portsentry[724]: attackalert: Host: 148.247.8.20 is
> already blocked. Ignoring
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users