Re: What's going on here?

[<wykkyd () ziplip com>]

In-Reply-To: <C2DC75EEA405354AA9C03EF5CB8CDE080AC912 () EXCHANGE xpert com>

> > FWIN,2002/08/23,18:47:42 -4:00 
> > GMT,10.60.1.102:80,xxx.xx.96.7:9176,TCP (flags:S)
> > FWIN,2002/08/23,18:47:42 -4:00 
> > GMT,10.10.2.105:80,xxx.xx.96.7:13682,TCP (flags:S)
>
> Someone is scanning a victim that's in reserved address-space,
> giving your address as decoy.
>
> see:
> http://www.rootshell.be/~helevius/nid_3pe_v101.pdf
>
> Regards,
> Yonatan.

No, if that was the case, they would have been SYN-ACK (or RST) packets, 
which they are not indicated as being.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com