From owner-freebsd-isp Tue Apr 24 13: 5: 4 2001 Delivered-To: freebsd-isp@freebsd.org Received: from wopr.caltech.edu (wopr.caltech.edu [131.215.102.114]) by hub.freebsd.org (Postfix) with ESMTP id 3825037B424 for ; Tue, 24 Apr 2001 13:04:58 -0700 (PDT) (envelope-from mph@wopr.caltech.edu) Received: (from mph@localhost) by wopr.caltech.edu (8.11.3/8.11.0) id f3OK4tF28320; Tue, 24 Apr 2001 13:04:55 -0700 (PDT) (envelope-from mph) Date: Tue, 24 Apr 2001 13:04:55 -0700 From: Matthew Hunt To: alex huppenthal Cc: free Subject: Re: IPFW ? hacked? Message-ID: <20010424130455.B27566@wopr.caltech.edu> References: <006301c0ccf5$4a5e4600$c800a8c0@aspenworks.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <006301c0ccf5$4a5e4600$c800a8c0@aspenworks.com>; from alex@aspenworks.com on Tue, Apr 24, 2001 at 01:32:21PM -0600 Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Tue, Apr 24, 2001 at 01:32:21PM -0600, alex huppenthal wrote: > Interestingly, I see 205.149.189.91 as a destination IP address at port 5999 > collecting data from x.x.18.3 > > I don't know 205.149.189.91 or have any process running to that site. > However, the numbers are increasing. Are you sure you don't know that site? wopr:~$ host cvsup2.freebsd.org cvsup2.freebsd.org is a nickname for burka.rdy.com burka.rdy.com has address 205.149.189.91 burka.rdy.com mail is handled (pri=20) by mail1.best.com burka.rdy.com mail is handled (pri=10) by burka.rdy.com wopr:~$ grep 5999 /etc/services cvsup 5999/tcp #CVSup file transfer/John Polstra/FreeBSD Dima is a FreeBSD committer (dima@freebsd.org). -- Matthew Hunt * Clearly there are more things in the http://www.pobox.com/~mph/ * heavens than anyone anticipated. -enp To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message