RE: Scanning from a "intruder.rs88.net"?

From: Simos Xenitellis (simosat_private)
Date: Sun May 27 2001 - 15:38:53 PDT

Next message: Patrick Andry: "Timing of DoS and Intrusion attempts."

Previous message: Matthew Jonkman: "Re: Scanning from a "intruder.rs88.net"?"
In reply to: Jason Lewis: "RE: Scanning from a "intruder.rs88.net"?"
Reply: James Friesen: "RE: Scanning from a "intruder.rs88.net"?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Sun, 27 May 2001, Jason Lewis wrote:

> What is running on the machine these logs came from?  Web, DNS, FTP?
>
> Microsoft boxes attempt to connect via NetBIOS or do WINS lookups on servers
> they are trying to use services on.  A windows box will try to connect on
> port 137 if it is trying to access your web server.  I dump all that traffic
> at my border router.

It is not a WWW server.
It appears to have ports 22 and 80 firewalled.

simos

Next message: Patrick Andry: "Timing of DoS and Intrusion attempts."
Previous message: Matthew Jonkman: "Re: Scanning from a "intruder.rs88.net"?"
In reply to: Jason Lewis: "RE: Scanning from a "intruder.rs88.net"?"
Reply: James Friesen: "RE: Scanning from a "intruder.rs88.net"?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon May 28 2001 - 06:25:57 PDT