[ILUG] possible attack...?

From: Vincent Cunniffe (vincent at domain cunniffe.net)
Date: Tue 09 May 2000 - 14:05:35 IST

Next message: Philip Reynolds: "Re: [ILUG] Fwd: will the love ever cease? <unix now targeted>"
Previous message: David Nicholls: "RE: [ILUG] Fwd: will the love ever cease? <unix now targeted>"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Mail actions: [ respond to this message ] [ mail a new topic ]

Recovered from log :

Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=21292 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=33580 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=42284 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=49196 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=51244 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=53548 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=63532 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=20781 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=26157 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=61485 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=4654 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=15918 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 62.6.71.136:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=34606 F=0x6000 T=18 (#0)
Suspect short first fragment.
eth0 PROTO=6 213.1.88.170:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=3077 F=0x6000 T=114 (#0)
Suspect short first fragment.
eth0 PROTO=6 213.1.88.170:0 nnn.nnn.nnn.nnn:0 L=20 S=0x00 I=3079 F=0x6000 T=114 (#0)

Does this look like an attack sequence on a Linux box?

Regards,

Vin

Next message: Philip Reynolds: "Re: [ILUG] Fwd: will the love ever cease? <unix now targeted>"
Previous message: David Nicholls: "RE: [ILUG] Fwd: will the love ever cease? <unix now targeted>"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Mail actions: [ respond to this message ] [ mail a new topic ]

This archive was generated by hypermail 2.1.6 : Thu 06 Feb 2003 - 13:06:04 GMT