Benjamin, I had the same scan occur on March 12 at 0449h EST from 200.21.200.239. It is most likely a search for the "rootkit t0rn". See http://www.sans.org/y2k/120400-1100.htm for a report on the SANS site. Ken McKinlay 613-599-9199 x506 [EMAIL PROTECTED] > -----Original Message----- > From: Benjamin Keller [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, March 13, 2001 11:05 > To: [EMAIL PROTECTED] > Subject: [FW1] Strange Service > > > > Hi All, > > Quick Question, > > I see in my logs that service 511 (looks like an attack) was > block, it seams > to be some kind of scan. I have tried to find what it is and > I am unable to > make heads or tales. > > Thanks in advance for the heads up, > > Benjamin Keller > Systems Administrator > Conceptis Technologies > > > > ============================================================== > ================== > To unsubscribe from this mailing list, please see the > instructions at > http://www.checkpoint.com/services/mailing.html > ============================================================== > ================== > ================================================================================ To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================================================
