RE: Increase in SSH scans

From: Paulo.Sedrezat_private
Date: Wed Oct 02 2002 - 00:08:11 PDT

Next message: Andrew Fison: "maybe a simple problem"

Previous message: Peter Kruse: "SV: Unusual volume: UDP:137 probes"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On 30-Sep-2002 Keith T. Morgan wrote:
># grep 'Sep\ 2[2-9]' /var/log/messages | grep 'DPT=22' | wc

Please, try something like:

# grep 'Sep 2[2-9]' /var/log/messages | grep 'PROTO=TCP .* DPT=22 ' | wc -l

This will avoid mixing UDP port 22 or ports 22* with TCP port 22.

-----
Paulo F. Sedrez
Diretor de Tecnologia
Weavers Network Consulting      Tel/Fax: +55-21-2239-3190
http://www.weavers.com.br       Paulo.Sedrezat_private
--------------------------
Thought of the day:

"Pascal is Pascal is Pascal is dog meat."
                -- M. Devine and P. Larson, Computer Science 340


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Andrew Fison: "maybe a simple problem"
Previous message: Peter Kruse: "SV: Unusual volume: UDP:137 probes"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Oct 02 2002 - 11:11:26 PDT