Firewall Wizards mailing list archives

Re: increased SQL probes

From: "Dave Piscitello" <dave () corecom com>
Date: Thu, 14 Oct 2004 15:24:40 -0400

On 14 Oct 2004 at 14:21, Paul D. Robertson wrote:

On Thu, 14 Oct 2004, Dave Piscitello wrote:
For which server?  There's been some MySQL stuff announced recently,
and some Oracle stuff...


Judging from the probe patterns, they know my web server is IIS so 
are going after W2K(03). SQLs not open (duh). My observations from 
blocked packet and auto-blocked site log entries.

Any data on source or distribution of the probes (number, number from
an IP, duration...?)


Randomizing source IPs, but this new load is nearly entirely from 
64.53.x.y 

My IPs are in this space as well. 


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

Current thread:

increased SQL probes Dave Piscitello (Oct 14)
- Re: increased SQL probes Paul D. Robertson (Oct 14)
  - Re: increased SQL probes Dave Piscitello (Oct 14)
- <Possible follow-ups>
- RE: increased SQL probes Behm, Jeffrey L. (Oct 14)
- RE: increased SQL probes Melson, Paul (Oct 15)