Re: Unknown progran "XXX YYY ZZZ"

From: Dave Baker (newsgroup_poster_at_jodael.com)
Date: 05/27/05


Date: Fri, 27 May 2005 08:41:39 +0800

On Wed, 25 May 2005 22:22:52 -0500, Winged <Winged@nofollow.com> wrote:

>It is just a hunch but I have seen various scan tools post the xxx yyy
>zzz combination in the security logs. A scan could also explain the
>reason your system your system slowed to a crawl. A novice user of the
>product might decide to run a full throttle probe of your system with
>either a specific group of probes or full scan. I would have thought
>the firewall should have locked out the scan activity. But the attacker
>"might" have been flooding your connection. If you had nic requests
>ongoing it might have explained the system slowdown.

Thanks for the info - I do have some logging capability in the router which I
haven't been using. I'll enable that & check it when/if this ever happens
again.

Dave

The email address used for sending these postings is not valid.
All replies to the group please.