[prev in list] [next in list] [prev in thread] [next in thread] 

List:       incidents
Subject:    Loopback traffic on the net
From:       Sven Carstens <s.carstens () gmx ! de>
Date:       2001-09-20 10:50:01
[Download RAW message or body]

Hi all,

after setting the snort rules for nimda to pass I enjoyed the sudden silenc=
e
screaming through my network.
But then I find this more philosophical entries in the logs:

Occuring from 4 ascending source ports: 62249 - 62252
All within in the same second.
First: 127.0.0.1 -> 62.208.xx.xx:80  ACK no payload
Then: 127.0.0.1 -> 62.208.xx.xx:80 RST payload 'tcp_lift_anchor, can't wait=
'

The destination is not within my jurisdiction but is on the same net as the=
 sensor.

Don't know what that is or were it really came from. Only thing I know is t=
hat
it seems to be in a real hurry :)

CU Sven


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

[prev in list] [next in list] [prev in thread] [next in thread]