On Mon, 4 Nov 2002, Ingersoll, Jared wrote: > Nov 1 01:42:44 2U:10.1.1.1 Nov 01 2002 01:50:32: %PIX-2-106016: Deny IP > spoof from (0.0.0.0) to x.x.x.5 We're seeing them too, since Nov 1 03:30 GMT, approx. 150 per a day. TCP SYNs to port 445 on different IPs. An interesting detail is that all of them have IP ID == 256. TTL appears to vary between 108 and 113. --Pavel Kankovsky aka Peak "Welcome to the Czech Republic. Bring your own lifeboats." ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Nov 06 2002 - 18:03:28 PST