Yeah both could be true, and maybe even if someone is portscanning your entire I.P block, which is probably not all owned by you or something. It's not necessary that all ports be scanned, some hackers scan only those ports on which services run which are exploitable by their tools. Like portmap and ftp ports, and so on. So maybe your portmap port is also scanned but you only see ftp logs and do not have any tools like snort or so. The best way is to block them off firewall or simply don't do anything, firewalling them on your end will not make the network uncongested, you have to block them on a screening router or firewall.
goodluck though =) Regards, --------- Muhammad Faisal Rauf Danka Chief Technology Officer Gem Internet Services (Pvt) Ltd. web: www.gem.net.pk voice: 92-021-111-GEMNET "Great is the Art of beginning, but Greater is the Art of ending. " ------BEGIN GEEK CODE BLOCK---- Version: 3.1 GCS/CM/P/TW d- s: !a C++ B@ L$ S$ U+++ P+ L+++ E--- W+ N+ o+ K- w-- O- PS PE- Y- PGP+ t+ X R tv+ b++ DI+ D G e++ h! r+ y+ ------END GEEK CODE BLOCK------ --- TheOg <[EMAIL PROTECTED]> wrote: >I agree with Chris , though it could be someone scanning for anonymous ftp >servers , is it one ip? multiple ip addresses? > >_|_ |__ ___ __ __ > |_, | ) (__/_ (__) (__| > __/ > > >On Mon, 22 Apr 2002, Chris Santerre wrote: > >> This could be someone using a password cracker. Trying many logins and not >> waiting for them to finish. Doesn't sound like a port scan if it is only >> FTP. >> >> When I first read your subject, I thought you were talking about an old >> trick we used to play on people in college. We would place the logout >> command in their login script :) Ah, those were the days! >> >> Chris >> "Campus Computings worse nightmare" >> >> -----Original Message----- >> From: Peter Schumacher [mailto:[EMAIL PROTECTED]] >> Sent: Saturday, April 20, 2002 3:51 AM >> To: [EMAIL PROTECTED] >> Subject: ftp server: receiving quit before login is finished >> >> >> Hi, >> >> on our ftp servers I see sometimes thousands of hits which generate just >> a: >> >> "Receiving quit before login is finished" >> >> Mostly from the same or up to 3 ip addresses, it repeats normally >> within a few seconds to a minute and contiunes over days if I don't >> block the ip addresses in the firewall. >> >> Any idea which tools generate this? >> >> TIA! >> -- >> >> Greetings, >> [4D-Consulting.com]eK, Wiesbaden >> Peter Schumacher >> -------------------------------------------------------- >> Web: http://www.4D-Consulting.com/ >> 0800-4D-Infos / 0800-43.46.367 - Fax: 0800-43.46.637 >> Intl +49-611-9406.850 - Intl: +49-611-9406.744 >> _____________________________________________________________ --------------------------- [ATTITUDEX.COM] http://www.attitudex.com/ --------------------------- _____________________________________________________________ Run a small business? Then you need professional email like [EMAIL PROTECTED] from Everyone.net http://www.everyone.net?tag
