Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 2 subscribers
  • Views 3059 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Attack? Or False Positive?

Marvin_B
Internet goes down and I see this in my firewall intrusion protection log...

2014:01:31-10:07:55 mail ulogd[4618]: id="2102" severity="info" sys="SecureNet" sub="ips" name="portscan detected" action="portscan" fwrule="60017" initf="eth1" srcmac="30:e4[:D]b[:D]a:a4:13" dstmac="0:15:17:37:a4:79" srcip="41.86.104.50" dstip="167.102.218.254" proto="17" length="3944" tos="0x18" prec="0x60" ttl="106" srcport="53" dstport="52093" 
2014:01:31-10:07:55 mail ulogd[4618]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="eth1" srcmac="30:e4[:D]b[:D]a:a4:13" dstmac="0:15:17:37:a4:79" srcip="172.246.126.128" dstip="167.102.218.254" proto="17" length="72" tos="0x00" prec="0x00" ttl="48" srcport="53" dstport="55398" 
2014:01:31-10:07:56 mail ulogd[4618]: id="2102" severity="info" sys="SecureNet" sub="ips" name="portscan detected" action="portscan" fwrule="60017" initf="eth1" srcmac="30:e4[:D]b[:D]a:a4:13" dstmac="0:15:17:37:a4:79" srcip="87.106.15.108" dstip="167.102.218.254" proto="17" length="72" tos="0x00" prec="0x00" ttl="42" srcport="53" dstport="59634" 
2014:01:31-10:07:56 mail ulogd[4618]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="eth1" srcmac="30:e4[:D]b[:D]a:a4:13" dstmac="0:15:17:37:a4:79" srcip="210.225.93.226" dstip="167.102.218.254" proto="17" length="72" tos="0x00" prec="0x00" ttl="43" srcport="53" dstport="32201" 
2014:01:31-10:07:57 mail ulogd[4618]: id="2102" severity="info" sys="SecureNet" sub="ips" name="portscan detected" action="portscan" fwrule="60017" initf="eth1" srcmac="30:e4[:D]b[:D]a:a4:13" dstmac="0:15:17:37:a4:79" srcip="209.11.240.36" dstip="167.102.218.254" proto="17" length="72" tos="0x00" prec="0x00" ttl="45" srcport="53" dstport="10899" 
2014:01:31-10:07:58 mail ulogd[4618]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="eth1" srcmac="30:e4[:D]b[:D]a:a4:13" dstmac="0:15:17:37:a4:79" srcip="211.98.71.10" dstip="167.102.218.254" proto="17" length="151" tos="0x00" prec="0x00" ttl="233" srcport="53" dstport="58886"


This thread was automatically locked due to age.
Parents Reply Children
No Data