Great Circle Associates Firewalls
(July 1997)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: FW-1 logs....is this an attack...?
From: Cihan Subasi <csubasi @ garanti . com . tr>
Organization: Garanti Ticaret
Date: Thu, 31 Jul 1997 16:44:44 -0700
To: Firewalls <firewalls @ greatcircle . com>, Checkpoint Mailing List <fw-1-mailinglist @ us . checkpoint . com>
Reply-to: csubasi @ garanti . com . tr

When someone accesses our Web server in DMZ I receive the following log
which is logical,

	http	194.242.77.89	WEbServer	tcp	7	1036

but sometimes I receive the folloving log entry which looks like our web
server is tyring to http outside...
	
	1029 	Webserver	194.54.33.242	tcp	12	http

What I understand is prot 80 of my web server is making a request from
1029 of a remote host...

	Help please,
-- 

****************************************************************************
Cihan Subasi,    
Garanti Ticaret AS,Istanbul Turkey	
email:csubasi @
 garanti .
 com .
 tr tel: +902126570404	fax: +902126570473
****************************************************************************


Follow-Ups:
Indexed By Date Previous: Re: klaxon
From: Doug Hughes <Doug . Hughes @ Eng . Auburn . EDU>
Next: Re: Move to news group
From: jal @ mcs . le . ac . uk
Indexed By Thread Previous: Merits
From: chester <chester @ cpgl . cpg . com . au>
Next: Re: FW-1 logs....is this an attack...?
From: Nobuhiko Yoshimoto <yoshi @ koto . nikkei . co . jp>

Google
 
Search Internet Search www.greatcircle.com