From owner-freebsd-security@FreeBSD.ORG  Tue Sep  9 01:15:54 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 80AC016A4BF
	for <freebsd-security@freebsd.org>;
	Tue,  9 Sep 2003 01:15:54 -0700 (PDT)
Received: from mail-pm.star.spb.ru (mail-pm.star.spb.ru [217.195.82.1])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B579543FE1
	for <freebsd-security@freebsd.org>;
	Tue,  9 Sep 2003 01:15:44 -0700 (PDT)
	(envelope-from nkritsky@internethelp.ru)
Received: from pink.star.spb.ru ([217.195.82.10])
	by mail-pm.star.spb.ru (8.12.9/8.12.8) with ESMTP id h898Ffr5075269;
	Tue, 9 Sep 2003 12:15:42 +0400 (MSD)
Received: from IBMKA ([217.195.82.7]) by pink.star.spb.ru with SMTP (Microsoft
	Exchange Internet Mail Service Version 5.5.2653.13)
	id SK41D8LR; Tue, 9 Sep 2003 12:15:41 +0400
Date: Tue, 9 Sep 2003 12:15:37 +0400
From: "Nickolay A. Kritsky" <nkritsky@internethelp.ru>
X-Mailer: The Bat! (v1.49) Personal
X-Priority: 3 (Normal)
Message-ID: <28136359484.20030909121537@internethelp.ru>
To: Randy Bush <randy@psg.com>
In-reply-To: <E19wavc-000LTN-VI@ran.psg.com>
References: <E19wavc-000LTN-VI@ran.psg.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
cc: freebsd-security@freebsd.org
Subject: Re: is one of my hosts a scanner?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: "Nickolay A. Kritsky" <nkritsky@internethelp.ru>
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 09 Sep 2003 08:15:54 -0000

Hello Randy,

Tuesday, September 09, 2003, 9:20:36 AM, you wrote:

RB> clues?

try to identify process that sends this packets. Use lsof or sockstat
for that.

;-------------------------------------------
; NKritsky
; mailto:nkritsky@internethelp.ru