[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW-1] Ftp hijacking?
Try the following: Do a virus scan Use different FTP software Do an Adware software scan with the free tool from www.adaware.com Use a different machine (maybe the one u're using has some Advert programs running which intercept connections.) -----Original Message----- From: Scott Murray [mailto:[email protected]] Sent: 24 May 2002 5:02 PM To: [email protected] Subject: [FW-1] Ftp hijacking? I am seeing some strange things in my fw logs. If I try to telnet to an FTP server on our DMZ segment on port 21, I see an appropriate log entry of "drop" due to the any/any/drop rule, which is fine. But IMMEDIATELY after that drop, the same exact second, there are two other FTP drops from two seperate IP addresses on rule zero going to the same destination as I was going to. Thinking this was a fluke, I tried again about six times and the problem reproduced itself each time but coming from different IP addresses. Each IP address also originated from placed like Jerusalem, Taiwan, China, France, etc...places not even close to being part of the route. Has anyone seen something like this before? I checked our IDS and I don't see anything out of the ordinary there or on the local logs on the FTP server. Scott _________________________________________________________________ Chat with friends online, try MSN Messenger: http://messenger.msn.com ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] ================================================= ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
|