Under Attack?

[Greyhatter]

Re: Under Attack?

he got a phone call from an angry guy complaining that a customer on their network pinged him.

Was that annoyed customer calling from beyond the great firewall?

You know, I wonder out of all the ports I get red pings on what they could possibly be looking for even if they found it? Just for fun I should set up an IP with certain security ports open and put some tasty cheese in a VE for the guys at 211...... Would be fun to see what falls into my trap, what they would do while in there, and while I tracked them back to their front porch, what they were having for lunch/dinner at that time.. probably Internet Pizza Hut delivery.

[streaker69]

Re: Under Attack?

Then again, some of us are being pinged more than others as of late...

http://www.informationweek.com/news/...es+and+threats

Many years ago when a buddy of mine was working at a Mom & Pop ISP, he got a phone call from an angry guy complaining that a customer on their network pinged him.

[Greyhatter]

Re: Under Attack?

Then again, some of us are being pinged more than others as of late...

http://www.informationweek.com/news/...es+and+threats

[xor]

Re: Under Attack?

If you like PSAD you should check out a book called Linux Firewalls by Michael Rash. Perhaps you all ready have.

xor

[xor]

Re: Under Attack?

My PSAD (Port-Scan Attack Daemon) and Firestarter have been picking up alot of attempted port and kernel attacks lately. The attacker has been using German proxies and all of my traces keep leading to Germany -> Russia -> Sweden -> Japan -> China -> Spain -> and finally stopping in Toronto, Canada.

It really doesn't bother me because it reeks of script-kiddie but I was wondering if anyone else has been getting randomly scanned lately.

I don't doubt you are getting scanned from abroad. I must be doing something right, the most intrusion attempts I see are from google trying to index my stuff.

xor

[Greyhatter]

Re: Under Attack?

Calm down dude. The East always pings us.

[SarperDomain]

My PSAD (Port-Scan Attack Daemon) and Firestarter have been picking up alot of attempted port and kernel attacks lately. The attacker has been using German proxies and all of my traces keep leading to Germany -> Russia -> Sweden -> Japan -> China -> Spain -> and finally stopping in Toronto, Canada.

It really doesn't bother me because it reeks of script-kiddie but I was wondering if anyone else has been getting randomly scanned lately.