Recent worms have been known to hit port 515, there's an vulnerability in
lprng which enables an attacker to execute arbitrary code. I assume these
packets are the result of the recent worms.
On Sat, Jun 30, 2001 at 10:13:01PM +0300, Cedar Cox wrote:
>
> What is one to think of this? These "random" packets have hit my firewall
> on port 515 recently.. comments?
>
>
>
> -- Attached file included as plaintext by Listar --
> -- File: log.txt
>
> Jun 26 22:01:20 Packet log: PROTO=6 64.123.230.249:58963 L=60 S=0x00 I=18619
>F=0x4000 T=47 SYN (#23)
> Jun 26 22:01:22 Packet log: PROTO=6 64.123.230.249:58963 L=60 S=0x00 I=18955
>F=0x4000 T=47 SYN (#23)
> Jun 26 22:01:28 Packet log: PROTO=6 64.123.230.249:58963 L=60 S=0x00 I=19617
>F=0x4000 T=47 SYN (#23)
> Jun 26 22:52:15 Packet log: PROTO=6 213.113.152.232:4902 L=60 S=0x00 I=20130
>F=0x4000 T=34 SYN (#23)
> Jun 26 22:52:18 Packet log: PROTO=6 213.113.152.232:4902 L=60 S=0x00 I=21423
>F=0x4000 T=34 SYN (#23)
> Jun 29 09:42:41 Packet log: PROTO=6 194.3.198.211:1857 L=60 S=0x00 I=9035 F=0x4000
>T=46 SYN (#25)
> Jun 29 09:42:44 Packet log: PROTO=6 194.3.198.211:1857 L=60 S=0x00 I=9228 F=0x4000
>T=46 SYN (#25)
> Jun 30 12:40:09 Packet log: PROTO=6 210.51.0.18:3582 L=60 S=0x00 I=54279 F=0x4000
>T=44 SYN (#26)
> Jun 30 12:40:12 Packet log: PROTO=6 210.51.0.18:3582 L=60 S=0x00 I=55581 F=0x4000
>T=44 SYN (#26)
> Jun 30 21:27:18 Packet log: PROTO=6 209.155.224.20:3715 L=60 S=0x00 I=24436 F=0x4000
>T=42 SYN (#26)
>
> =================================================================
> To unsubscribe, send mail to [EMAIL PROTECTED] with
> the word "unsubscribe" in the message body, e.g., run the command
> echo unsubscribe | mail [EMAIL PROTECTED]
>
=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]
