port 520 RIP

["Kirk A. Ellsworth" <kirk () solutionsconsultingits com>]

All,

My netgear firewall FVS318 of 10.0.1.200 is hitting another linux firewall and filling the logs on the box.  Linux 
firewall is on the 192.168.0.1 network.  The logs is not my problem I can set them to limit, but I am wondering how to 
turn it off, or why is this happening.  It is hitting every few seconds.  

can anyone explain???

thanks in advance

ke

-----Original Message-----
From: Steve Bremer [mailto:steveb () nebcoinc com]
Sent: Tuesday, October 15, 2002 2:33 PM
To: Chris S
Cc: security-basics () securityfocus com
Subject: Re: Ipchains Question / Seeking Information.



>  Is my webserver trying to make connections going out
> on these ports, or is my webserver being attacked on these ports. 


Whether your web server is infected with the worm or not, I can't say 
for sure. But, according to the logs you've provided, it does appear 
to be your web server trying to connect to 65.56.237.226 on port 
2002.

Steve Bremer
NEBCO, Inc