> On Thu, Nov 22, 2001 at 11:24:43AM +0200, Marco Slaviero wrote:
> > The user has restricted (sftp, and a change passwd script) access to the box.
> > It does not seem to be the crc32 attack. The user logged on about 136 time in
> > an hour, and disconnected almost immediately. Anyone seen this before?
I got 30 or more 'simultaneous' hits from one IP this afternoon
driving load to 76 on a SunOS server.
Homer
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu Nov 22 2001 - 16:56:17 PST