RE: Weird IP

["Prodigi Child" <prodigi.child () gmail com>]

Try a trace route from the web server to the IP Address(es) in the logs and
see where that goes. Maybe there is a network that you don't know about
somewhere that is connected to yours behind the firewall (like a Wireless
access point plugged into the LAN).

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Debarko De
Sent: Tuesday, February 03, 2009 8:00 AM
To: Ricardo Carrillo
Cc: security-basics () securityfocus com
Subject: Re: Weird IP

We are talking of a web server compromisation so I don't think that no
reply policy of UDP packets gets any consideration. I would suggest
that the system logs be checked to verify any unauthorized acces to
the web server logs as system logs are much harder to mess with. Also
this case has all system compromisation written over it.