Date: Wed, 4 Nov 1998 14:42:36 +0500 (KGT) From: CyberPsychotic <mlists@gizmo.kyrnet.kg> To: Alla Bezroutchko <alla@sovlink.ru> Cc: security@FreeBSD.ORG Subject: Re: Is it an attack? Strange things logged by ipfw. Message-ID: <Pine.BSF.3.96.981104143706.11812D-100000@gizmo.kyrnet.kg> In-Reply-To: <363EBD86.74C9F6E2@sovlink.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
~ ~ Nov 3 00:44:53 buddy /kernel: ipfw: 65534 Deny TCP a.b.c.d:50818 ~ aaa.aaa.aaa.aaa:1333 in via ex0 ~ Nov 3 01:12:51 buddy /kernel: ipfw: 65534 Deny TCP e.f.g.h:50818 ~ aaa.aaa.aaa.aaa:1565 in via ex0 ~ Nov 2 11:15:37 buddy /kernel: ipfw: 65534 Deny TCP i.j.k.l:50818 ~ aaa.aaa.aaa.aaa:1725 in via ex0 ~ Oct 20 04:20:03 buddy /kernel: ipfw: 65534 Deny TCP m.n.o.p:50818 [snip snip] ~ ~ What stumbles me is why they all use the same source port. nothing special. You could bing locally any port you want. It doesn't seem like a probing either, since these ports aint registered among reserved port numbers. could be kind of troyan probin'.. yeah, but hardly.. troyans love to use 31337 ports :-)). as someone already mentioned: Nothing will help brain-damaged windoze machines. :) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.96.981104143706.11812D-100000>