Security Incidents mailing list archives

RE: HTTP connections

From: Ryan Russell <ryan () securityfocus com>
Date: Thu, 19 Jul 2001 21:17:32 -0600 (MDT)

On Fri, 20 Jul 2001, Dean Cunningham wrote:

Looks like code red , but  not seeing the 3 hits per ip address, just one.
May be due to the different FW logs, I use Firewall-1.


I was getting three SYN packets per attempt.  For simple port-blocking
firewalls, they may log it as three entries.  Firewall-1 will treat it as
one "connection" attempt, and log it as a single item.

                                        Ryan



----------------------------------------------------------------------------


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see:

http://aris.securityfocus.com

Current thread:

HTTP connections Gillard, Paul (Jul 19)
- Re: HTTP connections Chris Freeze (Jul 19)
- Re: HTTP connections Ryan Russell (Jul 19)
  - Other China Hack Attempts Concurrent With Code Red David E. Weekly (Jul 19)
- <Possible follow-ups>
- RE: HTTP connections Dean Cunningham (Jul 19)
  - RE: HTTP connections Ryan Russell (Jul 19)
- RE: HTTP connections Lindsay (Jul 22)