Security Incidents mailing list archives

Re: SMTP server (How can I find out the real source of an attack)

From: Valdis.Kletnieks () vt edu
Date: Thu, 12 Jul 2001 21:59:32 -0400

On Thu, 12 Jul 2001 15:53:36 PDT, MrG <p2mask2_xti () yahoo com>  said:

1.I have a SMTP server (behind my FW) who constantly
(>7 times per second) is trying to establish a TCP=25

I know that my SMTP server  has been compromise but


How do you *know* it's been compromised?

I've seen multiple systems that don't understand the meaning of "required
delay before retry" as per RFC1123 - systems that in their normally broken
state will retry over and over and over.  I can sympathize with your
7x/sec - I once got hit by something that retried 10x/sec for about 2 days
before I finally found the owner and chastised them....

-- 
                                Valdis Kletnieks
                                Operating Systems Analyst
                                Virginia Tech

Attachment: _bin
Description:

Current thread:

SMTP server (How can I find out the real source of an attack) MrG (Jul 12)
- Re: SMTP server (How can I find out the real source of an attack) Valdis . Kletnieks (Jul 13)
  - Re: SMTP server (How can I find out the real source of an attack) Pavel Kankovsky (Jul 16)
    - Re: SMTP server (How can I find out the real source of an attack Nick FitzGerald (Jul 17)
- RE: SMTP server (How can I find out the real source of an attack) Mike Batchelor (Jul 13)
- Re: SMTP server (How can I find out the real source of an attack) kath (Jul 13)
  - Re: SMTP server (How can I find out the real source of an attack) Mike Lewinski (Jul 16)
- <Possible follow-ups>
- RE: SMTP server (How can I find out the real source of an attack) Dean Cunningham (Jul 13)