Another odd scan...

From: Adam Young (adamat_private)
Date: Thu Jul 11 2002 - 18:56:35 PDT

Next message: Matt Scarborough: "Re: Can anyone identify this backdoor?"

Previous message: Brooke, O'neil (EXP): "Lessons Learned from the MPAA's use of DCMA"
Next in thread: Wolf, Glenn: "RE: Another odd scan..."
Reply: Wolf, Glenn: "RE: Another odd scan..."
Reply: Jose Nazario: "Re: Another odd scan..."
Reply: Muhammad Faisal Rauf Danka: "Re: Another odd scan..."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

--SNIP--
Jul 11 21:52:48 element kernel: (catch-all logging):: IN=eth0 OUT= MAC=*
SRC=80.97.2.93 DST=24.215.x.y LEN=60 TOS=0x00 PREC=0x00 TTL=34 ID=64252
DF PROTO=TCP SPT=33124 DPT=77 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0 
--SNIP--

	I got this for about 2 minutes, every 20 seconds or so, I just thought
it especially weird with "CWR ECE SYN", looking as to what the meaning
of this is.

	Any help is appreciated greatly,

		Adam

application/pgp-signature attachment: stored

Next message: Matt Scarborough: "Re: Can anyone identify this backdoor?"
Previous message: Brooke, O'neil (EXP): "Lessons Learned from the MPAA's use of DCMA"
Next in thread: Wolf, Glenn: "RE: Another odd scan..."
Reply: Wolf, Glenn: "RE: Another odd scan..."
Reply: Jose Nazario: "Re: Another odd scan..."
Reply: Muhammad Faisal Rauf Danka: "Re: Another odd scan..."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Jul 12 2002 - 15:14:11 PDT