Suspicious firewall logs

From: Wong Wai Kit (wwkitat_private)
Date: Thu Jul 31 2003 - 19:16:39 PDT

Next message: Barry Fitzgerald: "Re: RPC DCOM exploit"

Previous message: Russell Fulton: "ISS command line scanner for RPC/DCOM vulnerability"
Next in thread: MARLON BORBA: "Re: Suspicious firewall logs"
Reply: MARLON BORBA: "Re: Suspicious firewall logs"
Reply: Ben Timby: "Re: Suspicious firewall logs"
Reply: Adcock, Matt: "RE: Suspicious firewall logs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi,
     I had one incidents which is require for your help. My firewall keep prompting some traffiics from internal LAN IPs trying to access this group of destination IPs for "http" service
 
208.172.144.155
208.172.158.234
208.172.128.132
208.172.192.132
208.172.224.132
208.174.16.132
208.172.13.253
 
Actually, my question is why my internal LAN(few IPs) keep trying to access this group of destination IP for http service. My LAN if want to go out internet, it should go through our proxy first. It not suppose go out to external directly.
 
Thanks...

Next message: Barry Fitzgerald: "Re: RPC DCOM exploit"
Previous message: Russell Fulton: "ISS command line scanner for RPC/DCOM vulnerability"
Next in thread: MARLON BORBA: "Re: Suspicious firewall logs"
Reply: MARLON BORBA: "Re: Suspicious firewall logs"
Reply: Ben Timby: "Re: Suspicious firewall logs"
Reply: Adcock, Matt: "RE: Suspicious firewall logs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Aug 01 2003 - 09:54:36 PDT