Re: Is this normal?

[Kluge <kluge () blackroses com>]

    Why couldn't it be the case here?  Somebody could very well be 
making direct attacks against the machine -- but trying to hide the 
attempts by flooding that same box with massive amounts of b.s. probes... 
This is an ancient technique...

-k


On Wed, 27 Oct 2004, Barrie Dempster wrote:

> On Fri, 2004-10-22 at 12:34 -0300, Joe Polk wrote:
> > It's not necessarily unusual. Someone is scanning for open ports and such and
> > is attempting to come in.
> <snip>
>
> They most certainly are not, in this case.
> You can't scan for open ports if the packets contain a fake return
> address like this. In order for the scanning machine to know that a port
> is open it requires something to be sent back (ie.. SA). as has been
> mentioned before this is most likely a syn flood type attack.
>
> --
> Barrie Dempster (zeedo) - Fortiter et Strenue
>
>  http://www.bsrf.org.uk
>
> [ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]