It does not really look like some one is trying to break through your file wall, they are not sending acks or anything strange, they are simply trying to view content on your httpd server which you are not running I guess. Have they scanned any other ports?(other than the ICMP ping?) If I saw an port scan or ack packets I would be more concerned. If you have a dynamic IP it could be someone trying to return to a site they were at before... Usually a break in attempt will cause a lot more traffic that a http request. Jason On Thu, 2002-04-18 at 08:05, Wesley Allen wrote:
OK, Looking at my log file from my firewall reveals that not I've got people trying to through my firewall from...
66.189.81.226 (and 246) (http connect attempts) 62.163.126.100 (same domain as yesterday)
How do I track them back to the ISP's and send a message to their abuse@ address?
Someone's trying to ping me from 66.189.24.226 as well.
Am I being paranoid or could my isp be trying to crack my firewall to see if I've got any servers running?
Time to batten down the hatches...
Wes
_______________________________________________ Wlug mailing list Wlug@mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug