Any ideas?

["Piscitello, Frank" <frank () WCUPA EDU>]

I have what I'm assuming is a worm/scanner that is attempting to connect
to 68.202.199.235 on port 6667. The mystery is that the source IP seems
to be every address on my one student subnet. The IP packet is 60bytes
and the Frame is 74 bytes. There is no actual data.

Any ideas? 
-Frank 


------------------------------------------------------------------
Frank J. Piscitello, Jr. 
Information Security Manager    
Office of Information Security
West Chester University of PA
West Chester, PA 19383
Phone: 610-436-3192
Fax: 610-436-3110
http://www.wcupa.edu/infoservices/security/

Security is everyone's responsibility.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.