Security Incidents mailing list archives

Scans from Russia


From: "Infrastructure Dept." <infrastructure () narellan net>
Date: Wed, 20 Sep 2000 08:57:11 -0400

I check my logs more than daily so I usually catch stuff soon after the
occurrence. Here's something I saw this morning. Can someone tell me what
the flags mean or where I can find a list of 'flags'

Sep 20 00:27:21 ns1 scanlogd: From 213.156.132.118 to x.x.x.x ports 1999,
745, 602, 6003, 144, 3333, 32771, 53, 2049, ..., flags fSrpau, TOS 00, TTL
42, started at 00:27:19

And here's the Whois data

inetnum:     213.156.130.0 - 213.156.136.255
netname:     CSSMPSNET
descr:       Central Switching Station of MRT RF
descr:       Russia
country:     RU
admin-c:     KD544-RIPE
tech-c:      KD544-RIPE
status:      ASSIGNED PA
notify:      netadmin () css-mps ru
mnt-by:      TRANSINFORM-MNT
changed:     netadmin () css-mps ru 20000214
changed:     alex () tsi ru 20000223
source:      RIPE

route:       213.156.128.0/19
descr:       Company Transinform
origin:      AS12979
notify:      noc () tsi ru
mnt-by:      TRANSINFORM-MNT
changed:     sergey () tsi ru 20000223
source:      RIPE

person:      Dmitry V Kirosov
address:     2/1 Kalanchovskaya street
address:     Moscow
address:     RU-107174
phone:       +7 095 262-2620
fax-no:      +7 095 262-1531
e-mail:      dvk () css-mps ru
nic-hdl:     KD544-RIPE
changed:     pasha () glasnet ru 19980917
source:      RIPE



Mr. I.
Network Engineer / Ops Manager
Narellan (NorthEast) Inc.


Current thread: