I am receiving scanlogd messages from ftp.gwdg.de there is a wget ftp download scrip there is running yet this is the first time I am getting messages like this the downloading machine is masquared should the inner ip be as my real ip.
Can someone give a guidance what to check for
TIA
Everything is fine. The ftp server opens tcp connections in PORT mode to
your client. scanlogd interprets these as a scan.
We're getting these kinds of complaints every few days. Good luck that
more and more ftp clients use PASV mode as default transfer mode. There,
the client opens a data connection to the server, not the other way
around.
Roman.
--
- -
| Roman Drahtmüller