Strange traffic from a user ...

Strange traffic from a user ...

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 1692 bytes --]

Hi all

Can someone tell me what this is?

Feb  5 10:26:10 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.122 DST=24.26.4.32 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=32898
DF PROTO=TCP SPT=1745 DPT=3022 WINDOW=64240 RES=0x00 SYN URGP=0
Feb  5 10:26:11 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.122 DST=24.170.20.10 LEN=48 TOS=0x00 PREC=0x00 TTL=127
ID=33629 DF PROTO=TCP SPT=1788 DPT=1915 WINDOW=64240 RES=0x00 SYN URGP=0
Feb  5 10:26:12 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.122 DST=24.92.38.155 LEN=48 TOS=0x00 PREC=0x00 TTL=127
ID=34070 DF PROTO=TCP SPT=1780 DPT=2034 WINDOW=64240 RES=0x00 SYN URGP=0
Feb  5 10:26:12 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.122 DST=24.168.165.204 LEN=48 TOS=0x00 PREC=0x00 TTL=127
ID=34071 DF PROTO=TCP SPT=1781 DPT=3169 WINDOW=64240 RES=0x00 SYN URGP=0
Feb  5 10:26:12 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.122 DST=24.47.6.119 LEN=48 TOS=0x00 PREC=0x00 TTL=127
ID=34072 DF PROTO=TCP SPT=1783 DPT=3595 WINDOW=64240 RES=0x00 SYN URGP=0
Feb  5 10:26:12 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.122 DST=24.128.32.100 LEN=48 TOS=0x00 PREC=0x00 TTL=127
ID=34412 DF PROTO=TCP SPT=1764 DPT=2962 WINDOW=64240 RES=0x00 SYN URGP=0

The destinations appear to be dialup ip addresses. Maybe a worm or
spyware?

Regards

Ray

-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Strange traffic from a user ...

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 496 bytes --]

On Thu, 2004-02-05 at 10:44, Ray Leach wrote:
> Hi all
> 
> Can someone tell me what this is?
> 
<snip>
> The destinations appear to be dialup ip addresses. Maybe a worm or
> spyware?
> 
Or Kazaa ....

> Regards
> 
> Ray
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]