Re: connection request to port 25

[toothbrushhead () yahoo com (Joe Dauncey)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
This sounds like an attempted SYN attack. Though I would have thought that for it
to be successful the impact should be much more noticeable.

Joe

SHAIFUL HASHIM wrote:

> Archive: http://msgs.securepoint.com/ids
> FAQ: http://www.ticm.com/kb/faq/idsfaq.html
> IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
> HELP: Having problems... email questions to ids-owner () uow edu au
> NOTE: Remove this section from reply msgs otherwise the msg will bounce.
> SPAM: DO NOT send unsolicted mail to this list.
> UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
> -----------------------------------------------------------------------------
> Hi all,
>
> I believed one of the workstations in my university has been compromised. I've
> monitored any connection from outside to the machine using snort. What I've
> got are overwhelming connection request to port 25 with SYN bit set from
> multiple of hosts. Currently the mail has not been used much but the log have
> shown that the mail port is very active. Can you tell me what sort of attack
> this might be and what is possibly going on?
>
> Thanks
> Shaiful
> UKM
>
> ____________________________________________________________________
> Get free email and a permanent address at http://www.netaddress.com/?N=1

__________________________________________________
Do You Yahoo!?
Talk to your friends online with Yahoo! Messenger.
http://im.yahoo.com