On Wed, 1 Sep 1999, Newcomb, Kelly wrote:
> I'm getting repeated (regular intervals) ftp attempts to my firewall from an
> address (208.24.82.140) that I can't seem to track down. While the attempts
[whois.arin.net]
Sprint (NETBLK-SPRINTLINK-BLKS) SPRINTLINK-BLKS 208.0.0.0 -
208.35.255.255
United States Internet, Inc (NETBLK-SPRINT-D01840) SPRINT-D01840
208.24.64.0 - 208.24.95.255
Contact Sprint- or whoever owns sprintlink now? If you haven't already
tried the last resolvable hop - usit.net from here before it hits a filter.
> are being blocked, the continuing log messages are annoying. This has been
You should have a screening router on your border to block things you
don't want to log. Block the host address there.
> going on for quite a while now, and I'm wondering if something got caught in
> a loop and the attempts may not be malicious. (on the other hand... 8-O)
> Any thoughts?
If it's FTP, it's probably a munged FTPMirror config or something
similar. Generally if you're seeing the same address repeatedly trying
the same thing, someone typo'd an address or something.
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
[EMAIL PROTECTED] which may have no basis whatsoever in fact."
PSB#9280
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
