Re: twinkie

[bparis () SORRLAC COM (Paris, Bill)]

My ISP (dial-up account) always tries connecting to my box via AUTH (port
113) every time I send mail. There is nothing on my machine listening at
port 113. Could these 192.168.1.x boxes be sending mail at that time?

Bill Paris

> -----Original Message-----
> From: Vasiliy Kuznetsov [mailto:waso () NSTU RU]
> Sent: Tuesday, February 15, 2000 10:00 AM
> To: INCIDENTS () SECURITYFOCUS COM
> Subject: twinkie
>
>
> Good time of day!
> There are strange things are happens in my local network for
> an indefined period. I saw such records in maillog:
> Feb 13 23:46:35 perfect ipop3d[23091]: AUTHENTICATE twinkie
> failure host=[192.168.1.200]
> Feb 14 08:37:13 perfect ipop3d[24749]: AUTHENTICATE twinkie
> failure host=[192.168.1.141]
> Feb 14 08:51:31 perfect ipop3d[24812]: AUTHENTICATE twinkie
> failure host=[192.168.1.136]
>
> As you can see they are from different hosts, running
> win95-win98. What it could be?
>             10x,
>                     Vasiliy