Date: Fri, 30 May 2003 22:15:33 -0400 From: Todd Zimmermann <t.zim@att.net> To: freebsd-questions@freebsd.org Subject: Re: General DDOS curiousity Message-ID: <3ED81045.9020304@att.net> In-Reply-To: <44fzmwuksn.fsf@be-well.ilk.org> References: <3ED6BA5A.3000904@att.net> <44fzmwuksn.fsf@be-well.ilk.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Lowell Gilbert wrote: > Todd Zimmermann <t.zim@att.net> writes: > > >>This isn't so much a question as a curiosity I noticed tonight. >> >>I have a dialup account with att.net & get a dynamic ip in the 12.93 >>block. While logging in tonight and initializing ipfilter, I noticed >>7 blocked input packets right away. No big deal, but I checked my >>log. Each packet was from a diff ip, but all to port 41170 UDP... >> >>Now I'm up to 501 blocked packets, unique ips but same port. I've >>logged into scans before, but nothing like this. > > Sounds like one packet per second or less. If that's supposed to be a > DDOS, it isn't much of one. More likely, the previous holder of the > address was running some kind of server, maybe a node in a > peer-to-peer system. > > >Jeremy Faulkner wrote: > >>41170 is used by Piolet, a peer-to-peer file transfer program. Yeah I guess DDOS wasn't the best choice of words. When I logged out and grabbed another ip it disappeared. Thanks for answering my question. I get too excited over log events sometimes :) - Todd
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3ED81045.9020304>