Re: Any ideas?

[Paul Dokas <dokas () CS UMN EDU>]

On Mon, 19 Jan 2004 16:27:15 -0500, "Piscitello, Frank" <frank () WCUPA EDU> wrote:
> I have what I'm assuming is a worm/scanner that is attempting to connect
> to 68.202.199.235 on port 6667. The mystery is that the source IP seems
> to be every address on my one student subnet. The IP packet is 60bytes
> and the Frame is 74 bytes. There is no actual data.
>
> Any ideas?
> -Frank

Spoofed SYN flood.  I know because I've got one in my dorms that's attacking
random cable modems even as I type this.  I also had a large outbound SYN
flood against 68.202.199.235 earlier tonight.

I'm still attempting to track down the offending host on my network.

Paul
--
Paul Dokas                                            dokas () cs umn edu
======================================================================
Don Juan Matus:  "an enigma wrapped in mystery wrapped in a tortilla."

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.