Not sure if I follow with that one, per the following: Dec 8 05:24:28 delta kernel: Rejected:IN=ppp0 OUT= MAC= SRC=68.67.164.72 DST=216.144.8.165 LEN=48 TOS=0x00 PREC=0x00 TTL=106 ID=6970 DF PROTO=TCP SPT=4042 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0 Dec 8 05:24:31 delta kernel: Rejected:IN=ppp0 OUT= MAC= SRC=68.67.164.72 DST=216.144.8.165 LEN=48 TOS=0x00 PREC=0x00 TTL=106 ID=7018 DF PROTO=TCP SPT=4042 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0 Dec 8 05:24:37 delta kernel: Rejected:IN=ppp0 OUT= MAC= SRC=68.67.164.72 DST=216.144.8.165 LEN=48 TOS=0x00 PREC=0x00 TTL=106 ID=7043 DF PROTO=TCP SPT=4042 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0 Dec 8 15:40:19 delta kernel: Rejected:IN=ppp0 OUT= MAC= SRC=4.62.187.134 DST=216.144.8.191 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=34489 DF PROTO=TCP SPT=3857 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0 Dec 8 15:40:22 delta kernel: Rejected:IN=ppp0 OUT= MAC= SRC=4.62.187.134 DST=216.144.8.191 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=34701 DF PROTO=TCP SPT=3857 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0 Dec 8 15:40:28 delta kernel: Rejected:IN=ppp0 OUT= MAC= SRC=4.62.187.134 DST=216.144.8.191 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=35014 DF PROTO=TCP SPT=3857 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0 my second octect is 144, above the 127 rule. but, unless you are reading backwards (and the second being the third and the fourth being the first) then the 216 is still above the 127 rule... Then again, i may have missed part of the posts and spt could be originating from 445 as well, which in that case this could be just regular network rejects as usual. ,_____________________________________________________, \ Ryan Yagatich supportat_private \ / Pantek Incorporated (877) LINUX-FIX / \ http://www.pantek.com (440) 519-1802 \ / / \___E8354282324E636DB5FF7B8A6EDED51FD02C06C68D3DB695___\ On Tue, 17 Dec 2002, Stephen J. Friedl wrote: >Scott A.McIntyre wrote: > <SNIP> > >The scanning pattern *is* random, though with a twist. It uses the >rand() function twice to create a random IP address, but this function >only has 15 bits of pseudorandomness. The upshot is that the second and >fourth octets of the IP address will always be in the range 0..127. So >my IP at home (64.170.X.X) won't ever get any hits. </SNIP> > >Steve > > ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Dec 18 2002 - 11:33:48 PST