Re: MASSIVE ssh attack attempt

[filipg () CORONA EPS PITT EDU (Filip M. Gieszczykiewicz)]

On Tue, 15 Feb 2000, Mark Shirley wrote:
> Our network has been recving massive amounts of ssh connection attempts in a short period of time.
> Feb 15 22:02:13 entropy2 iplog[24745]: TCP: ssh connection attempt from
> 210.134.59.39:1297
> Feb 15 22:02:13 entropy2 iplog[24745]: TCP: ssh connection attempt from
> 36.56.53.111:1972
> Feb 15 22:02:16 entropy2 iplog[24745]: TCP: ssh connection attempt from
[snip]

Isn't it PCAnywhere that walks the range looking for its ilk on port 22
(ssh)? Are you sure it's a "ssh connection attempt" or is that your
logger interpretation of "pcA port 22 connection attempt"?

Cheers,
Filip G.

Filip "I'll buy a vowel" Gieszczykiewicz  |  http://www.repairfaq.org/
                                             (filipg () corona eps pitt edu)
I am the river itself and the leaf floating its currents.
I am steering. I am swept. I am.