- WLUG - wlug.mailman3.com

Re: [Wlug] I hate crackers (not the kind you eat)

by Brian J. Conway

> Looking at my log file from my firewall reveals that not I've got > people trying to through my firewall from... > > 66.189.81.226 (and 246) (http connect attempts) > 62.163.126.100 (same domain as yesterday) > > How do I track them back to the ISP's and send a message to their abuse@ > address? > > Someone's trying to ping me from 66.189.24.226 as well. [dogbert@ladyluck /]$ host 66.189.81.226 226.81.189.66.in-addr.arpa domain name pointer cpe-66-189-81-226.ma.charter.com.[dogbert@ladyluck /]$ host 62.163.126.100 100.126.163.62.in-addr.arpa domain name pointer a126100.upc-a.chello.nl. [dogbert@ladyluck /]$ host 66.189.24.226 226.24.189.66.in-addr.arpa domain name pointer cpe-66-189-24-226.ma.charter.com. > Am I being paranoid or could my isp be trying to crack my firewall to > see if I've got any servers running? Port scanning isn't illegal, I wouldn't be that concerned unless something actually gets broken into, and it doesn't sound like you're in imminent danger of that. There's a lot of noise that's gonna show up in firewall or PortSentry-type logs, especially on cable or DSL IP ranges, I really don't pay it much attention myself. It's your call, of course. Brian J. Conway bconway(a)wpi.edu "LINUX is obsolete" - Andrew S. Tanenbaum, creator of Minix - Jan 29, 1992

April 18, 2002

I hate crackers (not the kind you eat)

by Wesley Allen

OK, Looking at my log file from my firewall reveals that not I've got people trying to through my firewall from... 66.189.81.226 (and 246) (http connect attempts) 62.163.126.100 (same domain as yesterday) How do I track them back to the ISP's and send a message to their abuse@ address? Someone's trying to ping me from 66.189.24.226 as well. Am I being paranoid or could my isp be trying to crack my firewall to see if I've got any servers running? Time to batten down the hatches... Wes

April 18, 2002

Re: [Wlug] netbus attack...

by Phillip G Deneault

LOL, Netops has much better methods for annoying its users then using Netbus. :-) Wouldn't you agree Mike? :-) Phil On Wed, 17 Apr 2002, Michael Frysinger wrote: > dont let netops confuse you, its coming from them :/ > -mike > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Phil Deneault "We work in the dark, We do what we can, deneault(a)wpi.edu We give what we have. Our doubt is our passion, WPI NetOps and our passion is our task. The rest is the OpenVMS Guy maddness of art." - Henry James -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

April 17, 2002

Re: [Wlug] netbus attack...

by Michael Frysinger

dont let netops confuse you, its coming from them :/ -mike ----- Original Message ----- From: "Wesley Allen" <wallen(a)charter.net> To: <wlug(a)mail.wlug.org> Sent: Wednesday, April 17, 2002 12:51 Subject: [Wlug] netbus attack... > Hi, my firewall is detecting a "netbus attack" from an external source. > Anyway I can basically refuse connections? Nothing's gotten through > yet, but it's a pain to see someone doing it and I'd like to smack them > around a bit. Any ideas? > > Wes > > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

April 17, 2002

Re: [Wlug] netbus attack...

by Chuck Haines

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iptable -A INPUT -s IPOFATTACK -j DROP On 17 Apr 2002, Wesley Allen wrote: > Hi, my firewall is detecting a "netbus attack" from an external source. > Anyway I can basically refuse connections? Nothing's gotten through > yet, but it's a pain to see someone doing it and I'd like to smack them > around a bit. Any ideas? > > Wes > > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > - ---------------------------------------------- | Chuck Haines | AOL: CyberGrex | | GDC Webmaster | ICQ: 3707881 | | WPILA Lab Manager | Yahoo: CyberGrex_27 | | http://gdc.wpi.edu | MSN: CyberGrex | - ---------------------------------------------- "Geek by nature, Linux by choice." -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (OSF1) Comment: For info see http://www.gnupg.org iD8DBQE8vdFq7HPTHjUkyKwRAuq9AJ9GtulXC4x2rCIftAMfpcSrNX0vnACcCxZA O8jItcQM8R0BHfEZE9yhYWg= =N7JM -----END PGP SIGNATURE-----

April 17, 2002

Re: [Wlug] netbus attack...

by Wesley Allen

Ahh, yes, that's a good one. Wes On ed, 2002-04-17 at 12:56, Brian J. Conway wrote: > > Hi, my firewall is detecting a "netbus attack" from an external source. > > Anyway I can basically refuse connections? Nothing's gotten through > > yet, but it's a pain to see someone doing it and I'd like to smack them > > around a bit. Any ideas? > > It sounds like you already are refusing connections (or just dropping > the packets). If it looks like it's casual portscanning I'd just ignore > it. If it's coming from the same source constantly over a period of time, > send a nasty email to their provider's abuse@ address. =) > > -b > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

April 17, 2002

Re: [Wlug] netbus attack...

by Phillip G Deneault

And if its from a 130.215 address, please tell WPI Netops. We like to stop that kinda thing. :-) Phil On Wed, 17 Apr 2002, Brian J. Conway wrote: > > Hi, my firewall is detecting a "netbus attack" from an external source. > > Anyway I can basically refuse connections? Nothing's gotten through > > yet, but it's a pain to see someone doing it and I'd like to smack them > > around a bit. Any ideas? > > It sounds like you already are refusing connections (or just dropping > the packets). If it looks like it's casual portscanning I'd just ignore > it. If it's coming from the same source constantly over a period of time, > send a nasty email to their provider's abuse@ address. =) > > -b > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Phil Deneault "We work in the dark, We do what we can, deneault(a)wpi.edu We give what we have. Our doubt is our passion, WPI NetOps and our passion is our task. The rest is the OpenVMS Guy maddness of art." - Henry James -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

April 17, 2002

Re: [Wlug] netbus attack...

by Brian J. Conway

> Hi, my firewall is detecting a "netbus attack" from an external source. > Anyway I can basically refuse connections? Nothing's gotten through > yet, but it's a pain to see someone doing it and I'd like to smack them > around a bit. Any ideas? It sounds like you already are refusing connections (or just dropping the packets). If it looks like it's casual portscanning I'd just ignore it. If it's coming from the same source constantly over a period of time, send a nasty email to their provider's abuse@ address. =) -b

April 17, 2002

netbus attack...

by Wesley Allen

Hi, my firewall is detecting a "netbus attack" from an external source. Anyway I can basically refuse connections? Nothing's gotten through yet, but it's a pain to see someone doing it and I'd like to smack them around a bit. Any ideas? Wes

April 17, 2002

FOR SALE

by jeff

heya guys... times are tough...have to sell some stuff to stay afloat... so here goes... System A (workstation): HP Pavilion 8570C Pentium III 450 Mhz (Katmai) 192 MB Ram Voodoo 3/3000 Video Soundblaster Live! Value Linksys LNE100TX Ethernet 20 Gig Quantum Fireball IDE HD 32x CD-ROM HP CD-Writer Plus 8100 Series CDRW Floppy Cambridge Soundworks Desktop Speaker System (3-Way) HP Deskjet printer (no ink - very nice though) Samsung 753DF 17" monitor HP Internet Style Keyboard Logitech Firstmouse a little wear and tear but runs fine...have installed Win98SE and Mandrake/Red Hat/Debian several times with no problems... System B (router): Generic Case Doosey AMD K6-2 450 64 MB RAM Voodoo 3/2000 Video Soundblaster Live! Value 2X Netgear FA311 Ethernet 20 Gig Maxtor IDE HD No CDROM Floppy Desktop Speakers (generic) Visio (oldie) 15" color monitor same deal...a little wear and tear...but it's still up and running...i think uname -a was like over 100 days now...running debian 2.2r5 w/2.4.18 kernel...a mini-beast...runs fine... AND, if you act now, i'll include at least 10 xtra 20' CAT-5 cables to wire your dorm/apartment AND my linksys 4-port hub for FREE!!! (crowd ooh's and aah's) as is...must go...play with it first if you like...make an offer if you're interested! THANKS! -jeff MWBLUG (508)792-6070

April 17, 2002