Security Basics mailing list archives
proof of someone banner grabbing me?
From: rik <rik () m-net arbornet org>
Date: Sun, 7 Sep 2003 22:32:49 -0400 (EDT)
tonight when i checked my /var/log/authlog, i noticed the following - Sep 5 18:15:29 spartacus sshd[32045]: Did not receive identification string from 68.73.0.31 Sep 5 18:15:44 spartacus sshd[8613]: Bad protocol version identification '\^V\^C\^A' from 68.73.0.31 Sep 5 18:15:44 spartacus sshd[5376]: Bad protocol version identification '\^V\^C' from 68.73.0.31 Sep 5 18:15:49 spartacus sshd[9297]: Did not receive identification string from 68.73.0.31 Sep 5 18:15:50 spartacus sshd[27589]: Bad protocol version identification 'GET / HTTP/1.0' from 68.73.0.31 Sep 5 18:16:17 spartacus sshd[25053]: Connection closed by 68.73.0.31 Sep 5 18:16:17 spartacus sshd[6638]: Connection closed by 68.73.0.31 Sep 5 18:16:17 spartacus sshd[28447]: Connection closed by 68.73.0.31 Sep 5 18:16:17 spartacus sshd[25414]: Connection closed by 68.73.0.31 Sep 5 18:16:17 spartacus sshd[10489]: Did not receive identification string from 68.73.0.31 Sep 5 18:16:18 spartacus sshd[8764]: Connection closed by 68.73.0.31 Sep 5 18:17:02 spartacus sshd[30620]: Bad protocol version identification '`' from 68.73.0.31 Sep 5 18:17:02 spartacus sshd[25307]: Bad protocol version identification '`/bin/id` #' from 68.73.0.31 Sep 5 18:17:02 spartacus sshd[24725]: Bad protocol version identification '`/usr/bin/id` #' from 68.73.0.31 Sep 5 18:17:04 spartacus sshd[19385]: Did not receive identification string from 68.73.0.31 am i correct in believing this is someone's attempt to enumerate info on my machine? thanks in advance, -r --------------------------------------------------------------------------- Captus Networks Are you prepared for the next Sobig & Blaster? - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans - Precisely Define and Implement Network Security - Automatically Control P2P, IM and Spam Traffic FIND OUT NOW - FREE Vulnerability Assessment Toolkit http://www.captusnetworks.com/ads/42.htm ----------------------------------------------------------------------------
Current thread:
- proof of someone banner grabbing me? rik (Sep 08)
