[unisog] lots of ftp on March 12?

Pat Wilson paw at noh.ucsd.edu
Wed Mar 13 23:49:13 GMT 2002


May be, for dshield types.  I don't know how they count or
compute timezones...  I usually see a lot of ftp scans, certainly,
but it's *very* rare to see so many that run between the same
hours and ignore our "attractive nuisances" completely.

Pat Wilson
Network Security Manager
UCSD ACS/Network Operations
paw at ucsd.edu
6F3A AE75 F931 3A19 D207 19F3 DB9B 29DC 2C3F E015

Jeff Anderson-Lee <jonah at eecs.berkeley.edu> writes:
>  According to dsheld.org, Mar 12 was a relatively "light" day for reports
>  of port 21 probes, although the days around it were heavy.  See:
>  
>  http://www.dshield.org/port_report.php?port=21
>  
>  Date                Count     Percent of Submissions
>  2002-03-13     40125      9.67%  
>  2002-03-12     10808      1.17%  
>  2002-03-11     109829      9.34%  
>  2002-03-10     133692      9.99%  
>  2002-03-09     18929      1.91%  
>  2002-03-08     30876      3.60%  
>  2002-03-07     29242      3.41%
>  
>  Jeff Anderson-Lee
>  Systems Manager, Digital Library Project
>  UC Berkeley
>  
>  Pat Wilson wrote:
>  
>  >Did anyone else see _lots_ of ftp probes yesterday (March 12th)?
>  >We've got what appear to be coordinated scans of one of our class Bs
>  >from about 10 external hosts.  Weird.  AFACIT, there wasn't
>  >anything special about the probes...
>  >
>  >
>  >Pat Wilson
>  >Network Security Manager
>  >UCSD ACS/Network Operations
>  >paw at ucsd.edu
>  >6F3A AE75 F931 3A19 D207 19F3 DB9B 29DC 2C3F E015
>  >
>  



More information about the unisog mailing list