RE: denial of svc in wwwerror

even more interesting is trying to ping or tracert to that IP address:

Pinging 66.20.54.145 with 32 bytes of data:

Reply from 172.17.17.210: TTL expired in transit.
Reply from 172.17.17.210: TTL expired in transit.
Reply from 172.17.17.210: TTL expired in transit.
Reply from 172.17.17.210: TTL expired in transit.

Ping statistics for 66.20.54.145:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum =  0ms, Average =  0ms

I think that someone was out to "get" you.


-------------------------
 Bryan Dietz
3X Corporation







Jim Langston <jlangston@celsinc.com>
Sent by: web400-admin@midrange.com
04/02/2002 10:42 PM
Please respond to web400


        To:     "'web400@midrange.com'" <web400@midrange.com>
        cc:
        Subject:        RE: [WEB400] denial of svc in wwwerror


My guess, IP 66.20.54.145 tried to do too many connections too fast, so it
was seen as a DOS attack.

Interesting that they forgot to interpret the 1108620945 into dotted IP
notation, which is the same as the 66.20.54.145.

Just my guess though.

Regards,

Jim Langston

-----Original Message-----
From: Jim Franz [mailto:franz400@triad.rr.com]

i had never seen this in logs before (at V4R5)

15:58:44 +0000]Input timer expired 66.20.54.145
15:58:48 +0000]                                                Denial of
service attack detected from IP 1108620945
15:58:48 +0000]Input timer expired 66.20.54.145
15:58:49 +0000]OK                  66.20.54.145                Denial of
service: new connection accepted for attacking IP 1108620945
15:58:52 +0000]OK                  66.20.54.145                Denial of
service: new connection accepted for attacking IP 1108620945
15:59:15 +0000]OK                  66.20.54.145                Denial of
service: new connection accepted for attacking IP 1108620945

any details on what triggers this?

jim
_______________________________________________
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/web400
or email: WEB400-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.