[96820] in RedHat Linux List
Re: Port 1 attack?
daemon@ATHENA.MIT.EDU (Mike Johnson)
Thu Oct 29 13:30:25 1998
Date: Thu, 29 Oct 1998 12:53:24 -0500
To: redhat-list@redhat.com
From: Mike Johnson <Mike.Johnson@GSC.GTE.Com>
In-Reply-To: <36387BC7.15228312@radix.net>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
At 09:29 AM 10/29/98 -0500, you wrote:
>I'm runnining abacus sentry on my linux server, and had someone try and
>telnet into port 1 - which triggered the sentry, and then blocked their
>IP address for any incomming and outgoing packets.
Having never used abacus sentry (considering it), I'm just guessing, here.
When the sentry is triggered and it 'blocks' their IP address, does it
do the blocking via IPFW rules? If so, it could have been a port scan.
Some script kiddy using a port scanner and starting at 1 and going all
the way up. If the IPFW rules kicked in, they would not have been able
to scan any of the other ports.
Just my thought...
Mike
--
Mike Johnson - mike.johnson@gsc.gte.com
Network Engineer - Prototype Development
GTE Government Systems - All opinions are mine, not GTE's.
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com http://archive.redhat.com
To unsubscribe: mail redhat-list-request@redhat.com with
"unsubscribe" as the Subject.
