Strange smtp activity?

From: Joe Kellner (jdk@kingsmeadefarm.com)
Date: 08/26/02


Date: Mon, 26 Aug 2002 11:18:51 -0400
From: Joe Kellner <jdk@kingsmeadefarm.com>
To: security-basics@securityfocus.com


Has anyone else been getting odd smtp activity? Starting today I've been seeing
alot of:

11:14:58.884534 211.160.14.157.4876 > me.com.smtp: . ack 769 win 16752 (DF)
11:14:59.198938 211.160.14.157.4876 > me.com.smtp: P 383:414(31) ack 769 win
16752 (DF)
11:14:59.199054 me.com.smtp > 211.160.14.157.4876: . ack 414 win 5840 (DF)

type packets. I never see anything getting queued, so I have to assume it's garbage.

-------------------------------------------------
sent via KingsMeade secure webmail http://www.kingsmeadefarm.com