NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [FW-1] Ftp hijacking?



Try the following:

Do a virus scan
Use different FTP software
Do an Adware software scan with the free tool from www.adaware.com
Use a different machine (maybe the one u're using has some Advert programs
running which intercept connections.)

-----Original Message-----
From: Scott Murray [mailto:[email protected]]
Sent: 24 May 2002 5:02 PM
To: [email protected]
Subject: [FW-1] Ftp hijacking?


I am seeing some strange things in my fw logs. If I try to telnet to an FTP
server on our DMZ segment on port 21, I see an appropriate log entry of
"drop" due to the any/any/drop rule, which is fine. But IMMEDIATELY after
that drop, the same exact second, there are two other FTP drops from two
seperate IP addresses on rule zero going to the same destination as I was
going to. Thinking this was a fluke, I tried again about six times and the
problem reproduced itself each time but coming from different IP addresses.
Each IP address also originated from placed like Jerusalem, Taiwan, China,
France, etc...places not even close to being part of the route. Has anyone
seen something like this before? I checked our IDS and I don't see anything
out of the ordinary there or on the local logs on the FTP server.

Scott

_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com

=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================

=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.