On 08/10/02 14:06 -0400, Chris S wrote:
> I'm getting a good amount of these DENY's in my logs, but I'm not sure
> exactly what they mean.
>
> Oct 7 19:51:45 furby kernel: Packet log: output DENY eth0 PROTO=6
> 216.178.84.110:80 65.56.237.226:2002 L=48 S=0x00 I=17224 F=0x4000 T=64 (#2)
The S
> Is my webserver trying to make connections going out
> on these ports, or is my webserver being attacked on these ports.
>
Whether your web server is infected with the worm or not, I can't say
for sure. But, according to the logs you've provided, it does appear
to be your web server tryi
You might try checking this out:
http://www.cert.org/advisories/CA-2002-27.html
Look like you have the slapper worm...
Hope this helps.
-Andrew
Andrew H. Turner <[EMAIL PROTECTED]>
BBN Technologies, a Verizon Company
1300 N. 17th Street, Suite 1200
Arl
