Security Incidents mailing list archives

UDP to 161


From: JNelson () CMCCONTROLS COM (CL: Nelson, Jeff)
Date: Thu, 10 Feb 2000 15:52:44 -0500


Good day,

Forgive me if this question is obvious or redundant. We have an established
pattern of attempts and denials at our company in two incidents from two
different IP addresses. Logs show this:

Jan 26 08:41:55 [Firewall_IP] %PIX-2-106006: Deny inbound UDP from
ForeignIP/1025 to OurEmailServer-Internal/161
Jan 26 08:41:56 [BorderRouter_IP] 1031822: %SEC-6-IPACCESSLOGP: list 110
permitted udp ForeignIP(1025) -> AnExternalOfOurs(161), 1 packet

Can I be sure that 161, in this instance, is still SNMP? The connection to
AnExternalOfOurs happens because it is outside our firewall. I figure
somebody is probing to find out information for future attempts.

Cheers,

Jeff

::::::::
Jeffrey L. Nelson
Network Manager
Cleveland Motion Controls


Current thread: