Newsgroup: it.comp.sicurezza.varie
Titolo: ZoneAlarma alert

Salve a tutti.
Il mio firewall ZoneAlarm ieri mi ha inviato un messaggio di allarme che
indicava un tentativo di accesso non autorizzato.
Fin qui niente di strano, se non fosse che il tentativo si e' ripetuto per
183 volte in pochi minuti:
" The firewall has blocked routed traffic from 151.5.160.149 [...]
Occurred: 183 times between 17/09/02 23.34.42 and 18/09/02 0.34.22 "
e successivamente:
" Occurred: 78 times between 18/09/02 0.34.52 and 18/09/02 0.47.26 "
ho provato a fare una ricerca per l'IP segnalato con il database Ripe.net;
il risultato che ho avuto e' il seguente:
************************************************************************************
% This is the RIPE Whois server.
% The objects are in RPSL format.
% Please visit 
http://www.ripe.net/rpsl
 for more information.
% Rights restricted by copyright.
% See 
http://www.ripe.net/ripencc/pub-services/db/copyright.html
inetnum:      0.0.0.0 - 255.255.255.255
netname:      IANA-BLK
descr:        The whole IPv4 address space
country:      NL
admin-c:      IANA1-RIPE
tech-c:       IANA1-RIPE
status:       ALLOCATED UNSPECIFIED
remarks:      The country is really worldwide.
remarks:      This address space is assigned at various other places in
remarks:      the world and might therefore not be in the RIPE database.
mnt-by:       RIPE-NCC-HM-MNT
mnt-lower:    RIPE-NCC-HM-MNT
mnt-routes:   RIPE-NCC-NONE-MNT
changed:      
bitb...@ripe.net
 20010529
changed:      
bitb...@ripe.net
 20020625
source:       RIPE
route:        
151.5.0.0/16
descr:        INFOSTRADA
origin:       AS1267
cross-mnt:    AS1267-MNT
mnt-lower:    AS1267-MNT
mnt-routes:   AS1267-MNT
mnt-by:       AS1267-MNT
changed:      
hostm...@iunet.it
 19991125
changed:      
hostm...@iunet.it
 20011009
source:       RIPE
role:         Internet Assigned Numbers Authority
address:      see 
http://www.iana.org
.
e-mail:       
bitb...@ripe.net
admin-c:      IANA1-RIPE
tech-c:       IANA1-RIPE
nic-hdl:      IANA1-RIPE
remarks:      For more information on IANA services
remarks:      go to IANA web site at 
http://www.iana.org
.
mnt-by:       RIPE-NCC-MNT
changed:      
bitb...@ripe.net
 20010411
source:       RIPE
inetnum:      151.0.0.0 - 151.255.255.255
netname:      IANA-NETBLOCK-151
descr:        This network range is not allocated to APNIC.
descr:        
descr:        If your whois search has returned this message, then you have
descr:        searched the APNIC whois database for an address that is
descr:        allocated by another Regional Internet Registry (RIR).
descr:        
descr:        Please search the other RIRs at 
whois.arin.net
 or
whois.ripe.net
descr:        for more information about that range.
country:      AU
admin-c:      IANA1-AP
tech-c:       IANA1-AP
remarks:      For general info on spam complaints email 
sp...@apnic.net
.
remarks:      For general info on hacking & abuse complaints email
ab...@apnic.net
.
mnt-by:       MAINT-APNIC-AP
mnt-lower:    MAINT-APNIC-AP
changed:      
hm-ch...@apnic.net
 20020530
status:       UNSPECIFIED
source:       APNIC
role:         Internet Assigned Numbers Authority
address:      see 
http://www.iana.org
.
e-mail:       
nob...@apnic.net
admin-c:      IANA1-AP
tech-c:       IANA1-AP
nic-hdl:      IANA1-AP
remarks:      For more information on IANA services
remarks:      go to IANA web site at 
http://www.iana.org
.
mnt-by:       MAINT-APNIC-AP
changed:      
nob...@apnic.net
 20020530
source:       APNIC
*****************************************************************************************
qualcuno puo' aiutarmi a fare luce su questa serie di dati incomprensibili?

ho provato a fare una ricerca per l'IP segnalato con il database Ripe.net;
Hai decisamente fatto la ricerca sbagliata
http://groups.google.com/groups?as_epq=routed%20traffic&as_ugroup=it.comp.sicurezza.*
-- 
Lapalissiano
Icq 57269703

 Occurred: 183 times between 17/09/02 23.34.42 and 18/09/02 0.34.22 "
Hai segato via con il [...] le uniche informazioni di qualche rilievo
su cui si possa basare un'ipotesi di valutazione dell'accaduto. Questo
in generale. Nel caso particolare, visto l'IP sorgente, probabilmente
il consiglio di lapalissiano ti portera' dritto alla soluzione. Non ti
preoccupare, non e' un problema di accesso non autorizzato: e' un falso 
positivo, come si dice in gergo.
Fabio