From owner-freebsd-security Mon Jul 9 22:18:54 2001 Delivered-To: freebsd-security@freebsd.org Received: from smtp2.jarna.com (mail.jarna.com [63.236.58.109]) by hub.freebsd.org (Postfix) with SMTP id 8DD8A37B407 for ; Mon, 9 Jul 2001 22:18:50 -0700 (PDT) (envelope-from nevin@jarna.com) Received: (qmail 31255 invoked by uid 0); 10 Jul 2001 05:18:49 -0000 Received: from unknown (HELO njk) (206.112.108.33) by smtp.jarna.com with SMTP; 10 Jul 2001 05:18:49 -0000 From: "Nevin Kapoor" To: Subject: RE: What is ipfw telling me ? Date: Mon, 9 Jul 2001 22:27:26 -0700 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <20010629195831.45162.qmail@d170h113.resnet.uconn.edu> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Folks, Non-authoritative answer: 20.46.239.216.in-addr.arpa name = crawl1.googlebot.com. This is simply a spider and not someone trying to "attack" you. I cannot imagine why nslookup wasn't the first thing you did after seeing this in your firewall log. /nk -----Original Message----- From: owner-freebsd-security@FreeBSD.ORG [mailto:owner-freebsd-security@FreeBSD.ORG]On Behalf Of Peter C. Lai Sent: Friday, June 29, 2001 12:59 PM To: George.Giles@mcmail.vanderbilt.edu Cc: freebsd-security@freebsd.org Subject: Re: What is ipfw telling me ? Machines from the 216.239.46. subnet has been trying to attack my machine as well, and this is not an isolated incident. Furthermore, i also know that i am not on the vanderbilt.edu network. Would looking at mynetwatchman's database help me figure out any other trends in attacks coming from 216.239.46? Currently i'm not running any firewall (since i am not running any unsafe ports); only log_in_vain is enabled, but I almost want to configure ipf/w just so i can block this whole subnet. George.Giles@mcmail.vanderbilt.edu writes: > What is ipfw telling me ? > > The 216 host is attempting to break in, but how is it using port 80 on the > other machine ? > > ipfw: 2400 Deny TCP 216.239.46.20:21602 10.0.0.1:80 in via xl0 > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message ----------- Peter C. Lai University of Connecticut Dept. of Residential Life | Programmer Dept. of Molecular and Cell Biology | Undergraduate Research Assistant/Honors Program http://cowbert.2y.net/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message