My first inclination is to say this is a web robot, a spider designed
to locate web servers and then index their pages.
Unless it grabbed stuff out of someone's table, I would think the IP
scanning would be sequential. But I really suspect a spider. If it is
home grown, that is what it is based off of.
Do you have any web servers? I'd make sure your robot.txt file is
configured the way you want it -- you don't want a robot to index
/etc/passwd and stick it out on a search engine server or something
goofy like that ;-)
Mark_W_Loveless @
smtp .
bnr .
com
______________________________ Reply Separator
_________________________________
Subject: Scanning from afar...
Author: netmgr02 @
cbe .
ab .
ca (Glen Larwill) at internet
Date: 2/1/96 2:42 PM
Has anyone seen this type of network scanning before? Addresses have
been changed to protect the inocent and the guilty.
Jan 30 11:14:41.922: %SEC-6-IPACCESSLOGP: list 111 denied tcp
X.X.143.14(39620) -> X.X.211.227(80), 1 packet
Jan 30 11:14:42.962: %SEC-6-IPACCESSLOGP: list 111 denied tcp
X.X.143.14(39621) -> X.X.211.243(80), 1 packet
<snip>
|
|
