intrusion detection
Eric
plug-discuss@lists.PLUG.phoenix.az.us
Mon, 24 Dec 2001 02:41:45 -0800
Hi,
My heart began to race when I saw this in one of my logs. If anyone can
read this log so as to divine whether this attempted hack was or may have
been successful, I would love to listen. I know that this is not the ideal
place to post this. Sorry if it offends.
FWIN,2001/12/22,19:57:38 -8:00 GMT,63.26.74.158:1665,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/22,23:50:12 -8:00 GMT,209.213.211.133:137,63.137.xx.xx:137,UDP
FWIN,2001/12/23,00:14:44 -8:00 GMT,131.220.233.203:22,63.137.xx.xx:22,TCP
(flags:S)
FWIN,2001/12/23,01:43:15 -8:00 GMT,207.33.111.34:4642,63.137.xx.xx:137,UDP
FWIN,2001/12/23,01:43:25 -8:00 GMT,207.33.111.34:2604,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:43:36 -8:00 GMT,207.33.111.34:2605,63.137.xx.xx:23,TCP
(flags:S)
FWIN,2001/12/23,01:43:41 -8:00 GMT,207.33.111.34:2607,63.137.xx.xx:22,TCP
(flags:S)
FWIN,2001/12/23,01:43:46 -8:00 GMT,207.33.111.34:2608,63.137.xx.xx:21,TCP
(flags:S)
FWIN,2001/12/23,01:43:51 -8:00 GMT,207.33.111.34:2609,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:43:56 -8:00 GMT,207.33.111.34:2612,63.137.xx.xx:25,TCP
(flags:S)
FWIN,2001/12/23,01:44:02 -8:00 GMT,207.33.111.34:2616,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:44:07 -8:00 GMT,207.33.111.34:2619,63.137.xx.xx:8080,TCP
(flags:S)
FWIN,2001/12/23,01:44:59 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:20,TCP
(flags:S)
FWIN,2001/12/23,01:44:59 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:59,TCP
(flags:S)
FWIN,2001/12/23,01:44:59 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:21,TCP
(flags:S)
FWIN,2001/12/23,01:44:59 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:23,TCP
(flags:S)
FWIN,2001/12/23,01:44:59 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:22,TCP
(flags:S)
FWIN,2001/12/23,01:44:59 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:79,TCP
(flags:S)
FWIN,2001/12/23,01:44:59 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:25,TCP
(flags:S)
FWIN,2001/12/23,01:45:05 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:20,TCP
(flags:S)
FWIN,2001/12/23,01:45:05 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:59,TCP
(flags:S)
FWIN,2001/12/23,01:45:05 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:21,TCP
(flags:S)
FWIN,2001/12/23,01:45:05 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:23,TCP
(flags:S)
FWIN,2001/12/23,01:45:05 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:22,TCP
(flags:S)
FWIN,2001/12/23,01:45:05 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:79,TCP
(flags:S)
FWIN,2001/12/23,01:45:05 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:25,TCP
(flags:S)
FWIN,2001/12/23,01:45:11 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:59,TCP
(flags:S)
FWIN,2001/12/23,01:45:11 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:25,TCP
(flags:S)
FWIN,2001/12/23,01:45:11 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:20,TCP
(flags:S)
FWIN,2001/12/23,01:45:11 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:23,TCP
(flags:S)
FWIN,2001/12/23,01:45:11 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:79,TCP
(flags:S)
FWIN,2001/12/23,01:45:11 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:21,TCP
(flags:S)
FWIN,2001/12/23,01:45:11 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:22,TCP
(flags:S)
FWIN,2001/12/23,01:45:17 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:59,TCP
(flags:S)
FWIN,2001/12/23,01:45:17 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:25,TCP
(flags:S)
FWIN,2001/12/23,01:45:17 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:20,TCP
(flags:S)
FWIN,2001/12/23,01:45:17 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:23,TCP
(flags:S)
FWIN,2001/12/23,01:45:17 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:79,TCP
(flags:S)
FWIN,2001/12/23,01:45:17 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:21,TCP
(flags:S)
FWIN,2001/12/23,01:45:17 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:22,TCP
(flags:S)
FWIN,2001/12/23,01:45:24 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:24 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:24 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:24 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:24 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:24 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:24 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:55,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:55,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:55,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:55,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:55,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:55,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:55,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:56,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:56,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:56,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:56,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:56,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:56,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:25 -8:00 GMT,207.33.111.35:56,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:57,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:57,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:57,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:57,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:57,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:57,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:57,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:58,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:58,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:58,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:58,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:58,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:58,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:58,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:26 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:82,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:82,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:82,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:82,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:82,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:82,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:82,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:83,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:83,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:83,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:83,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:83,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:83,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:27 -8:00 GMT,207.33.111.35:83,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:84,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:84,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:84,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:84,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:84,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:84,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:84,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:85,63.137.xx.xx:113,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:85,63.137.xx.xx:1080,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:85,63.137.xx.xx:445,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:85,63.137.xx.xx:443,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:85,63.137.xx.xx:110,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:85,63.137.xx.xx:1026,TCP
(flags:S)
FWIN,2001/12/23,01:45:28 -8:00 GMT,207.33.111.35:85,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,01:45:35 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:7,TCP
(flags:S)
FWIN,2001/12/23,01:45:35 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:3,TCP
(flags:S)
FWIN,2001/12/23,01:45:35 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:5,TCP
(flags:S)
FWIN,2001/12/23,01:45:35 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:8,TCP
(flags:S)
FWIN,2001/12/23,01:45:35 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:6,TCP
(flags:S)
FWIN,2001/12/23,01:45:35 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:4,TCP
(flags:S)
FWIN,2001/12/23,01:45:35 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:8080,TCP
(flags:S)
FWIN,2001/12/23,01:45:35 -8:00 GMT,207.33.111.35:53,63.137.xx.xx:2,TCP
(flags:S)
FWIN,2001/12/23,01:45:41 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:7,TCP
(flags:S)
FWIN,2001/12/23,01:45:41 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:3,TCP
(flags:S)
FWIN,2001/12/23,01:45:41 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:5,TCP
(flags:S)
FWIN,2001/12/23,01:45:41 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:8,TCP
(flags:S)
FWIN,2001/12/23,01:45:41 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:6,TCP
(flags:S)
FWIN,2001/12/23,01:45:41 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:4,TCP
(flags:S)
FWIN,2001/12/23,01:45:41 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:8080,TCP
(flags:S)
FWIN,2001/12/23,01:45:41 -8:00 GMT,207.33.111.35:54,63.137.xx.xx:2,TCP
(flags:S)
FWIN,2001/12/23,01:45:47 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:4,TCP
(flags:S)
FWIN,2001/12/23,01:45:47 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:7,TCP
(flags:S)
FWIN,2001/12/23,01:45:47 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:8080,TCP
(flags:S)
FWIN,2001/12/23,01:45:47 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:3,TCP
(flags:S)
FWIN,2001/12/23,01:45:47 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:5,TCP
(flags:S)
FWIN,2001/12/23,01:45:47 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:8,TCP
(flags:S)
FWIN,2001/12/23,01:45:47 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:6,TCP
(flags:S)
FWIN,2001/12/23,01:45:47 -8:00 GMT,207.33.111.35:80,63.137.xx.xx:2,TCP
(flags:S)
FWIN,2001/12/23,01:45:53 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:4,TCP
(flags:S)
FWIN,2001/12/23,01:45:53 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:7,TCP
(flags:S)
FWIN,2001/12/23,01:45:53 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:8080,TCP
(flags:S)
FWIN,2001/12/23,01:45:53 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:3,TCP
(flags:S)
FWIN,2001/12/23,01:45:53 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:5,TCP
(flags:S)
FWIN,2001/12/23,01:45:53 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:8,TCP
(flags:S)
FWIN,2001/12/23,01:45:53 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:6,TCP
(flags:S)
FWIN,2001/12/23,01:45:53 -8:00 GMT,207.33.111.35:81,63.137.xx.xx:2,TCP
(flags:S)
FWIN,2001/12/23,01:47:39 -8:00 GMT,209.213.211.133:137,63.137.xx.xx:137,UDP
FWIN,2001/12/23,04:48:20 -8:00
GMT,61.174.141.222:42445,63.137.xx.xx:8080,TCP (flags:S)
FWIN,2001/12/23,10:23:24 -8:00 GMT,63.137.30.29:137,63.137.xx.xx:137,UDP
FWIN,2001/12/23,10:48:08 -8:00 GMT,63.198.235.147:4530,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,14:44:23 -8:00
GMT,172.148.168.101:1119,63.137.xx.xx:1214,TCP (flags:S)
FWIN,2001/12/23,14:51:13 -8:00 GMT,209.254.182.49:3839,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,16:10:30 -8:00 GMT,63.48.17.251:2839,63.137.xx.xx:27374,TCP
(flags:S)
FWIN,2001/12/23,16:47:22 -8:00 GMT,209.213.211.133:137,63.137.xx.xx:137,UDP
FWIN,2001/12/23,17:47:23 -8:00 GMT,209.213.211.133:137,63.137.xx.xx:137,UDP
FWIN,2001/12/23,19:18:08 -8:00 GMT,63.98.54.205:3481,63.137.xx.xx:80,TCP
(flags:S)
FWIN,2001/12/23,23:47:07 -8:00 GMT,209.213.211.133:137,63.137.xx.xx:137,UDP
FWIN,2001/12/24,00:47:07 -8:00 GMT,209.213.211.133:137,63.137.xx.xx:137,UDP
Thanks,
Eric