[logs] Re: Netscreen logs

From: Nico Baggus (mlloganal@private)
Date: Wed Dec 07 2005 - 13:00:11 PST


Well,

someone has reset your device:


reset sequemce:  push the reset button for 4 to 6 second, release for a second 
and push it again for 4 to 6 second.

After that the device is virgin again.

Appearantly it had been managed using  then NSM management application.
And it basiclay tell you , that it's configuration is erased,
the eeprom is reset to initial values and that all associations with the 
managing NSM aaplication is lost.

If you pushed that button or ordered it to then probaply there is no problem,
if you didn't well then......

Kind regards,
Nico baggus


On Wednesday 07 December 2005 07:52, Lu Daohong wrote:
> Found these logs from a netscreen firewall seems malicious, somebody seen
> these:
>
> 1:Nov 30 18:01:53 xx.xx.xx.xx ns204: NetScreen device_id=ns204
> [Root]system-critical-00027: 2nd push has been confirmed. (2005-11-30
> 17:56:44)
>
> 2:Nov 30 18:01:59 xx.xx.xx.xx  ns204: NetScreen device_id=ns204
> [Root]system-critical-00027: Configuration Erase sequence accepted,
> unit reset.   (2005-11-30 17:56:50)
>
> 3:Nov 30 18:01:59 xx.xx.xx.xx  ns204: NetScreen device_id=ns204
> [Root]system-notification-00033: NSM keys were deleted. (2005-11-30
> 17:56:50)
>
> Thanks in advance!
>
> --
> Lu Daohong
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysis@private
> http://lists.shmoo.com/mailman/listinfo/loganalysis
_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis



This archive was generated by hypermail 2.1.3 : Wed Dec 07 2005 - 18:21:03 PST