I don't recall anything that uses port 12345. Nonetheless, someone is port
scanning your machine. I would suggest send a notification to uu.net
[EMAIL PROTECTED] and report the incident. Include the log file entries and tell
them your time zones.
Sorry to say I have never been satisfied with uu.net's efforts to stop
system crackers. Thus my host.deny file now has the line
ALL: .uu.net
WH Bouterse wrote:
> I had been warned on this list some months back
> to pay attenttion to attempted TCP connections
> from "unknown individuals"
>
> This morning I had:
>
> Dec 22 01:08:12 home portsentry[812]: attackalert: Connect from host:
> 1Cust163.tnt1.anchorage.ak.da.uu.net/63.28.217.163 to TCP port: 12345
> Dec 22 01:08:12 home portsentry[812]: attackalert: Host 63.28.217.163
> has been blocked via wrappers with string: "ALL: 63.28.217.163"
> Dec 22 01:08:12 home portsentry[812]: attackalert: Host 63.28.217.163
> has been blocked via dropped route using command: "/sbin/route add -host
> 63.28.217.163 gw 333.444.555.666"
>
> Okay I looked up in /etc/services and can not find that
> port listed?
>
> While I'm at it does this one make any sense to anyone?
> Dec 21 22:11:05 home routed[440]: packet from unknown router,
> 198.70.230.33
> Dec 21 22:11:36 home routed[440]: packet from unknown router,
> 198.70.230.33
>
> This has been going on for some time now. I have asked my
> ISP about it but after two weeks and several emails I am
> about to the "shrug my shoulders stage"
>
> Any help would be appreciated!
>
> William Bouterse
> Juneau Alaska
>
> --
> To unsubscribe: mail [EMAIL PROTECTED] with "unsubscribe"
> as the Subject.
--
robert canary
system services
OhioCounty.Net
[EMAIL PROTECTED]
(270)298-9331 Office
(270)298-7449 Fax
--
To unsubscribe: mail [EMAIL PROTECTED] with "unsubscribe"
as the Subject.
