× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  1.  Home
  2. MIDRANGE-L
  3. May 2009

RE: Is someone trying to hack my system?

I would say yes. These logs show that someone from the internet is connecting to your computer. If someone from the internet can connect to your computer, hackers from the internet can connect to your computer. It then follows that someone is trying to hack your system.

It does not follow that these examples are said hackers. You need to be able to define what normal use is. The fact that two of these are Chinese IPs and the other two are African (I think), would be a concern for us, but if you do business in China and Africa, maybe that's normal for you.

Try using netstat to determine if there is anything unexpected happening on the network.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Bob Voltz
Sent: Wednesday, May 20, 2009 10:03 AM
To: 'Midrange Systems Technical Discussion'
Subject: Is someone trying to hack my system?

While looking at QHST for something else, I noticed a lot of the following
messages:

TCP/IP connection to remote system 222.128.58.140 closed, reason code 2.
TCP/IP connection to remote system 222.128.58.140 closed, reason code 2.
TCP/IP connection to remote system 222.136.188.66 closed, reason code 2.
TCP/IP connection to remote system 222.136.188.66 closed, reason code 2.
TCP/IP connection to remote system 222.136.188.66 closed, reason code 2.
TCP/IP connection to remote system 222.136.188.66 closed, reason code 2.
TCP/IP connection to remote system 41.178.102.242 closed, reason code 2.
TCP/IP connection to remote system 41.208.151.250 closed, reason code 2.

Reason codes and their meanings follow:
1 = TCP connection closed due to expiration of 10 minute FINWAIT2 timer.
2 = TCP connection closed due to R2 retry threshold being run.

Does this mean the hackers are after me?!?!?



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.


As an Amazon Associate we earn from qualifying purchases.

This thread ...
Follow-Ups:
Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.