Security Incidents mailing list archives
Need help.
From: mlovett () WARRIOR MGC PEACHNET EDU (Melissa Lovett)
Date: Wed, 5 Jul 2000 15:54:13 -0400
The following appeared in the router event log. It appears that someone used FTP to do something, but I can't figure out anything. I have never seen anything like this in the log files before. I traced the address back to the UK. Any ideas? # 316: 07/01/00 04:43:23 DEBUG SLOT 3 GAME Event Code: 77 GID_CB: gate 0x060ea @ 0x3160b3f6 (RD=76678687) - gid_add: ADDING NEW SEGMENT free: head=0x00208 tail=0x00000->0x1ffff/0x002ff (cnt=248) curr: head=0x001c2 tail=0x000f0->0x00000/0x000f0 (cnt=150) next: head=0x00033 tail=0x001c3->0x00000/0x001c3 (cnt=113) # 317: 07/01/00 04:43:29 DEBUG SLOT 3 TCP Event Code: 14 TCP Open req: 16x.xx.xxx.x,21 - 194.117.155.79,4654 TCB: 0x31558260 # 318: 07/01/00 04:43:29 DEBUG SLOT 3 IP Event Code: 38 Interface 16x.xx.xxx.x: TCP port 21 to remote port 4654 allocated # 319: 07/01/00 04:43:29 INFO SLOT 3 TCP Event Code: 6 TCP Opened: 16x.xx.xxx.x,21 - 194.117.155.79,4654 TCB: 0x31558260 # 320: 07/01/00 04:43:33 DEBUG SLOT 3 IP Event Code: 39 Interface 16x.xx.xxx.x: TCP port 21 to remote port 4654 deallocated # 321: 07/01/00 04:46:47 INFO SLOT 3 IP Event Code: 28 IP Traffic Filter - Rule 16, Interface 16x.xx.xxx.x, Circuit 7 (Drop packet) # 322: 07/01/00 04:56:49 INFO SLOT 3 IP Event Code: 0 The previous event on slot 3 repeated 2 time(s). [Code 28] # 323: 07/01/00 04:58:32 DEBUG SLOT 3 FTP Event Code: 55 FTP debug message 827687520 - Error (15) in xmiting tcp buffer to the client. FTP debug message 829054800 - TCP Connection closed. Thanks, Melissa Lovett Middle Georgia College Network Services
Current thread:
- Need help. Melissa Lovett (Jul 05)