Educause Security Discussion mailing list archives
Re: StnyFtpd
From: Justin Azoff <JAzoff () UAMAIL ALBANY EDU>
Date: Thu, 17 Feb 2005 11:49:55 -0500
On Tue, 2005-02-15 at 08:33 -0600, Cam Beasley, ISO wrote:
FYI -- not sure if anyone else has noticed, but the StnyFtpd daemon (usually linked to various IRCbots) has a new and improved banner that you might want to be looking for: TCP=1024: '220 11111111 1111 j0' Your IRCbot sigs should normally trigger before a rule for this banner triggers, but.. ~cam.
It's not really new... I picked up a host with this on 2005-01-14 -- -- Justin Azoff -- Network Performance Analyst ********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/groups/.
Current thread:
- StnyFtpd Cam Beasley, ISO (Feb 15)
- <Possible follow-ups>
- Re: StnyFtpd Justin Azoff (Feb 17)