Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip)

On Fri, 2003-01-31 at 07:03, Tomasz Papszun wrote:
>
> Similarly at my networks.

We are also seeing these, tcp flags are RST+ACK seq number and window size both zero and varying Ack and ttl. Not all addresses in our net are being hit, in one /24 I checked only two addresses have been probed.

-- 
Russell Fulton, Computer and Network Security Officer
The University of Auckland,  New Zealand

"It aint necessarily so"  - Gershwin


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com