Printable View
My snort and firewall logs have been filling up with entries from a home/residential cable modem IP since about an hour ago and Im a bit confused about what they were trying to do. Can anyone tell me what might have been happening from this screenshot?
I cleaned up the logfile to only reflect entries from that IP and it has a lot more info...thanks to anyone who looks at this BTW :)
<Edit> ...not myself today...My IP removed
1st I now know your IP address ( next time try “ replace all “ before posting .. just a suggestion )
looks like a port scan by maybe a Bagle variant?
Is 192.168.1.101 infected?? Or maybe putting out some broadcasts? Otherwise, why the hammering on that internal box?
Do you have snort monitoring outbound connections as well?
Dshield says they submitted a fightback report to the ISP 1-31-2005 concerning that attacking address.
Yup...one of the boxes was infected...not sure how that could have happened. Thanks IKnowNot :)
Glad I could help!!