[Dshield] intrusion identification

Jeff Kell jeff-kell at utc.edu
Sat Mar 15 00:27:56 GMT 2003


Peter Lindgren wrote:
> My norton personal firewall blocked two incomming access atempts that 
> were attempting to aceess my netbios does anyone know how to find out 
> who made the attempt. The remote addresses were 63.208.81.100:2629 and 
> 63.208.112.117:4840

Yeah, and while you're at it, I've got a few from today I want to 
personally track down and give them a piece of my mind:

>     deny tcp any any range 135 139 (7630 matches)
>     deny udp any any range 135 netbios-ss (782774 matches)
>     deny tcp any any eq 445 (18991 matches)

Now where's my assault rifle :-)

Jeff



More information about the list mailing list