On Sun, 26 Dec 1999, you wrote:
what about messages like:
linux in.telnetd[4813] connect from 12.77.192.88
followed by peer died, invalid character
or
in.ftpd[8915] connect from 209.173.192.62
are these people connecting to my box? _____________________________________________________
Daniel Woodard
I would say yes someone is trying to connect to your computer. I would also hope that after that it says something about "connection refused . . .etc." If it doesn't chances are that they did connect to your computer. If they connected then you have to worry about weather or not they can get in. I would say you should look into setting up a firewall or at least turning off some services you don't need if this is happening alot. You can also configure IPs that you want to allow to connect to certain services and block others. Personnally I don't worry about it much when I get scanned because there is nothing on my computer to get to, but as I put alot of work into setting this up I watch the logs and still take the time to report people who try. Keep an eye on your log files and watch for repeated attempts. Every now and then I get what I would call a random message but if I see several then I start taking notes and doing whois searches etc. You might also consider running root-tail so you can see it when it happens too. Good luck. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Darren R. Weber drw@linuxfan.com ICQ# 2849193 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/