Re: New DNS connection with SYN ACK

From: Richard Arends (richardat_private)
Date: Fri Jan 11 2002 - 10:47:17 PST

Next message: John Oliver: "Strange traffic..."

Previous message: Ryan Russell: "Re: new codered worm penetrates content-filtering"
In reply to: Jerry Perser: "New DNS connection with SYN ACK"
Next in thread: Nick Drage: "Re: New DNS connection with SYN ACK"
Next in thread: Dan Hawrylkiw: "RE: New DNS connection with SYN ACK"
Reply: Nick Drage: "Re: New DNS connection with SYN ACK"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On 11 Jan 2002, Jerry Perser wrote:

> Here are the 19 ip addresses:
>
> 128.121.10.146 128.242.105.34
> 	129.250.244.10 193.148.15.128 194.205.125.26 194.213.64.150
> 	202.139.133.129 203.194.166.182 203.81.45.254 216.220.39.42
> 216.33.35.214
> 	216.34.68.2 216.35.167.58 62.23.80.2 62.26.119.34
> 	64.14.200.154 64.37.200.46 64.56.174.186 64.78.235.14

I'm getting scans for port 53 from the same ip's !

Greetings,

Richard.

----
An OS is like swiss cheese, the bigger it is, the more holes you get!


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: John Oliver: "Strange traffic..."
Previous message: Ryan Russell: "Re: new codered worm penetrates content-filtering"
In reply to: Jerry Perser: "New DNS connection with SYN ACK"
Next in thread: Nick Drage: "Re: New DNS connection with SYN ACK"
Next in thread: Dan Hawrylkiw: "RE: New DNS connection with SYN ACK"
Reply: Nick Drage: "Re: New DNS connection with SYN ACK"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Jan 11 2002 - 13:22:56 PST