[Snort-users] Curious FTP access, possible information gathering?

Travis Farmer travis57 at ...8615...
Fri Apr 4 17:45:05 EST 2003


Every once in a while, I get a connection on my FTP server that connects and
disconnects within about a second.
Normally, SYSLOG reports the login name if the user logs in (including
anonymous). there is no login noted. My impression is that the
client/script/virus is just connecting to gather the ftp server version
information.
I would write a rule to capture it, but if there is no login, then there is
no real data to capture (I assume). besides, it would flag all the time due
to connections.

I also noticed the connection triggered a "Lame server" for the same address
at "DNS2.1STSITE.NET" on my DNS server. but then, I think there is a out of
date root name server listed on it due to the fact I keep forgetting to
update the list.

~Travis
---
travis5765.homelinux.net,
Primary Administrator

TF Custom Electronic,
Owner, Founder, Developer





More information about the Snort-users mailing list