Re: [PATCH] Warn people that ipchains and ipfwadm are going away.

[Martijn Lievaart <m@rtij.nl>]

Gene Heskett wrote:

>[root@gene root]# grep attackalert /var/log/messages*
>/var/log/messages.1:Sep 16 18:09:16 gene portsentry[1159]: 
>attackalert: UDP scan from host: home1.bellatlantic.net/199.45.32.43 
>to UDP port: 32771
>/var/log/messages.1:Sep 16 18:09:16 gene portsentry[1159]: 
>attackalert: Host 199.45.32.43 has been blocked via wrappers with 
>string: "ALL: 199.45.32.43"
>/var/log/messages.1:Sep 16 18:09:17 gene portsentry[1159]: 
>attackalert: Host 199.45.32.43 has been blocked via dropped route 
>using command: "/sbin/iptables -I INPUT -s 199.45.32.43 -j DROP"
>/var/log/messages.1:Sep 16 18:09:17 gene portsentry[1159]: 
>attackalert: UDP scan from host: home1.bellatlantic.net/199.45.32.43 
>to UDP port: 32771
>/var/log/messages.1:Sep 16 18:09:17 gene portsentry[1159]: 
>attackalert: Host: home1.bellatlantic.net/199.45.32.43 is already 
>blocked Ignoring
>
>Time to send another nastygram to verizon since thats one of their 
>nameservers, and clear out that address from the hosts.deny file.
>
>FWIW, the last time that happened, in April 2003, the hack attempt  
>trashed a siemans router and I had to replace it with that linksys.  
>Must be time to change the user and password in it again too...
>
>FWIW, verizon has apparently a problem keeping their nameservers from 
>being hacked.
>  
>

Isn't this just the replies to legitimate dns queries? Wouldn't be the 
first time legitimate traffic is recognised as a portscan.

HTH,
M4