Curious FTP access, possible information gathering?

["Travis Farmer" <travis57 () megalink net>]

Every once in a while, I get a connection on my FTP server that connects and
disconnects within about a second.
Normally, SYSLOG reports the login name if the user logs in (including
anonymous). there is no login noted. My impression is that the
client/script/virus is just connecting to gather the ftp server version
information.
I would write a rule to capture it, but if there is no login, then there is
no real data to capture (I assume). besides, it would flag all the time due
to connections.

I also noticed the connection triggered a "Lame server" for the same address
at "DNS2.1STSITE.NET" on my DNS server. but then, I think there is a out of
date root name server listed on it due to the fact I keep forgetting to
update the list.

~Travis
---
travis5765.homelinux.net,
Primary Administrator

TF Custom Electronic,
Owner, Founder, Developer



-------------------------------------------------------
This SF.net email is sponsored by: ValueWeb: 
Dedicated Hosting for just $79/mo with 500 GB of bandwidth! 
No other company gives more support or power for your dedicated server
http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users