Rob, Can you be more specific? When you say "subseven scans" are you referring to the default port? If so, how do you know they were intended for subseven, and not the Linux worm (Lion or Ramen, I can't remember which) that utilized the same port? Just curious as to what other info you can provide...assuming, of course, that you're not simply talking about SYN packets that got dropped at the firewall... Thanks --- Rob Keown <Keownat_private> wrote: > Anyone else seeing a huge increase in subseven > scans...6708 since about > 0300Z - across all of my class C's and from quite a > few sources (running the > query now to see how many). > > Rob > > > ---------------------------------------------------------------------------- > This list is provided by the SecurityFocus ARIS > analyzer service. > For more information on this free incident handling, > management > and tracking system please see: > http://aris.securityfocus.com > __________________________________________________ Do You Yahoo!? HotJobs - Search Thousands of New Jobs http://www.hotjobs.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Aug 12 2002 - 12:02:42 PDT