Security Incidents mailing list archives

AW: What is this guy doing?

From: security () PEROTECH CH (Peter Roth)
Date: Thu, 8 Jun 2000 14:25:31 +0200


on June, 6th 2000 04:00, Josh Burroughs wrote:

I've seen this pattern showing up in my logs for the past few days, what
the hell is this guy trying to do?
Jun  5 16:52:11 discworld kernel: Packet log: input DENY eth0 PROTO=17
24.237.48.54:2301 255.255.255.255:2301 L=40 S=0x00 I=56747 F=0x0000 T=128


Hi

port 2301 -> default port for Compaq Insight Manager,
has some nice big securityholes in older versions.

Greetings

Peter

***************************************
Perotech GmbH, Peter Roth
Gewerbestrasse 12a, CH-8132 Egg
Tel. +41 1 9947606 / Fax +41 1 9947605
roth () perotech ch http://www.perotech.ch
***************************************

Current thread:

very strange scan patterns, (continued)
- - very strange scan patterns Joe H (Jun 05)
    - Re: very strange scan patterns John Kristoff (Jun 05)
    - Sub-7 Khan, Mansoor (Jun 05)
    - Re: Sub-7 James Stevenson (Jun 08)
    - Re: Sub-7 Matthew F. Caldwell (Jun 08)
    - Re: Sub-7 nine (Jun 08)
    - Strange scans - inquisitive question Paul Rogers (Jun 09)
    - Re: Strange scans - inquisitive question Valdis Kletnieks (Jun 11)
    - What is this guy doing? Josh Burroughs (Jun 05)
    - Re: What is this guy doing? Sebastien Reister (Jun 08)
    - AW: What is this guy doing? Peter Roth (Jun 08)
    - Port 6347 Dante Mercurio (Jun 08)
    - Re: Port 6347 Brian Macke (Jun 08)
    - Re: Port 6347 Henry F. Marquardt (Jun 09)
    - Re: What is this guy doing? Greg A. Woods (Jun 08)
    - Port-scans from visited web-sites? Peter Bates (Jun 07)
    - Re: Port-scans from visited web-sites? Joe McAlerney (Jun 08)
    - Re: Port-scans from visited web-sites? Greg A. Woods (Jun 08)
    - Re: Port-scans from visited web-sites? Erich Meier (Jun 10)
    - scan log Max Gribov (Jun 11)
    - Re: scan log Jason Witty (Jun 12)

(Thread continues...)