Date: Tue, 1 Jul 2003 14:32:54 +0300 From: Tarmo Renter <tarmo@momentor.ee> To: freebsd-security@freebsd.org Subject: tcp 22 > tcp 22 Message-ID: <200307011432.54750.tarmo@momentor.ee>
next in thread | raw e-mail | index | archive | help
Hi, I spotted today following line at my FreeBSD 4.6.2-RELEASE IPFIREWALL log: Jul 1 13:34:35 fbsd /kernel: ipfw: 1400 Accept TCP xxxxxx:22 yyyyy:22 in via ed1 where xxxxxx is the attacker's IP and yyyyy is my box. But in sshd log, there are no traces left behind by this connection. Normally, there is "Did not receive identification string from xxx" etc, when somebody tries to scan SSH port. Also, as you can see, the connection is made from port 22 to port 22, which is odd. Is this somekind of SYN packet trick and how come is no I/O to sshd made? sshd -v shows: sshd version OpenSSH_3.4p1 FreeBSD-20020702 --- Regards, Tarmo Renter
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200307011432.54750.tarmo>