Re: Traffic from microsoft.com ?

From: Bjorn Djupvik (bjorn.djupvikat_private)
Date: Sun Jul 01 2001 - 13:47:12 PDT

Next message: James Pruitt: "Re: Why would someone DoS a free-lance writer?"

Previous message: gabriel rosenkoetter: "Re: Why would someone DoS a free-lance writer?"
In reply to: Peter Bates: "Traffic from microsoft.com ?"
Next in thread: Peter Bates: "Re: Traffic from microsoft.com ?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I can make any IP delegated to me resolve to whatever I want, including
microsoft.com. Its the way reverse dns works, so the guy scanning you
probably made the ip resolve to microsoft.com to try and spoof the scan. Try
resolving microsoft.com and see if it resolves back to the ip, if it doesnt
then its obviously a fake.

Regards,
Bjorn

----- Original Message -----
From: "Peter Bates" <Peter.Batesat_private>

> Was this just the sign of a big spoofed scan, but if so, how come I can't
see
> any indication of an IP address that doesn't resolve to microsoft.com?




----------------------------------------------------------------------------


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see:

http://aris.securityfocus.com

Next message: James Pruitt: "Re: Why would someone DoS a free-lance writer?"
Previous message: gabriel rosenkoetter: "Re: Why would someone DoS a free-lance writer?"
In reply to: Peter Bates: "Traffic from microsoft.com ?"
Next in thread: Peter Bates: "Re: Traffic from microsoft.com ?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sun Jul 01 2001 - 14:52:41 PDT