Re: 2300 FTP accesses from Korea

[Russell Fulton <r.fulton () auckland ac nz>]

On Sun, 17 Jun 2001 22:48:41 -0700 Gregory McCann <cambria () owt com> 
wrote:

> Our log files show that someone at two different Korean ip addresses 
> tried to access our ftp server (ProFTPD 1.2.0) over 2,300 times on 
> Saturday.  What's the point? 

There probably is not point.  This activity probably was not 
intentional.  We have seen incidents like this several times over the 
last few years, in several cases the machine that initiated the 
activity was a cache.  

This is most likely a result of broken software on the orginating 
system.  Hmmm... I have also seen browsers retrying for ages when 
connecting to our main ftp server when we are refusing connections 
because the load is too high.


Russell Fulton, Computer and Network Security Officer
The University of Auckland,  New Zealand