RE: [cobalt-users] attackalert UDP port: 67 question

[Mark Roebuck <mroebuck@xxxxxxxxxxxxxxxxxxx>]

-----Original Message-----

on 3/4/01 1:57 pm, Mark Roebuck at mroebuck@xxxxxxxxxxxxxxxxxxx wrote:

> I have been getting the following in my logs for the last 19hrs:
> 
> Apr  3 13:16:41 www portsentry[796]: attackalert: Connect from host:
> 194.88.88.5/194.88.88.5 to UDP port: 67

<snip>

The problem is that the little beauty at 194.88.88.5, an NT Server is like
a little lost doggy who doesn't know how to get home for its boot
information.

And so it calls out wildly across the ether saying "Help do you have my
bootstrap information" .

And you, my friend are one of the thousands of people it's hit in trying.



either 

a. tell the owners that they should narrow their search for bootstrap data

b. tell portsentry to ignore this port. (Portsentry.conf warns that the
monitoring of UDP Port 67 is considered anal ;-)

c. Leave portsentry alone to block the attempters and configure Logcheck to
ignore the warning.

d. Invoice the IP owners for Disk space usage on your /var/log area ??!!??


Blessings
Revd Leonard Payne


a, c, d sound good to me.

Thanks for your help


Mark Roebuck