Re: [cobalt-users] RaQ2 ipfwadm question

["E.B. Dreger" <eddy+public+spam@xxxxxxxxxxxxxxxxx>]

GP> Date: Thu, 01 May 2003 13:27:43 -0400
GP> From: Glenn Parsons


GP> This is me from home on my DSL connection trying ftp (I'm not
GP> at home, but..):
GP>
GP> May  1 12:42:19 ns kernel: IP fw-in deny eth0 TCP 65.40.65.94:0
GP> 208.21.174.3:0 L=0 S=0x00 I=0 F=0x0000 T=0

I just noticed...

L=0 ?

How odd.  Sounds almost like an IP packet with protocol set to
TCP, but an empty body.


GP> May  1 12:13:08 mockups kernel: Packet log: input DENY eth0 PROTO=6
GP> 217.83.0.66:3460 208.21.174.6:21 L=52 S=0x01 I=49613 F=0x4000 T=119 SYN (#41)

Much more typical.


GP> And what is the deal with all the bogus European ftp hits
GP> since yesterday???

Not sure.  You might check out the dshield.org mailing list to
have a somewhat closer "ear to the ground" on this sort of
thing...


Eddy
--
Brotsman & Dreger, Inc. - EverQuick Internet Division
Bandwidth, consulting, e-commerce, hosting, and network building
Phone: +1 (785) 865-5885 Lawrence and [inter]national
Phone: +1 (316) 794-8922 Wichita

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Date: Mon, 21 May 2001 11:23:58 +0000 (GMT)
From: A Trap <blacklist@xxxxxxxxx>
To: blacklist@xxxxxxxxx
Subject: Please ignore this portion of my mail signature.

These last few lines are a trap for address-harvesting spambots.
Do NOT send mail to <blacklist@xxxxxxxxx>, or you are likely to
be blocked.