Newsgroup: it.cultura.single
Titolo: intruders

chi ci capisce  qualcosa , mi dice chi è 'sto pirla   che mi insidia la
SubSeven Port probe??
IP: 151.21.236.21
DNS: 
ppp-21-236.21-151.libero.it
Node: ENTERPRISE
Group: FEDERAZIONE
MAC: 005345000000
Luisa'Gnuranta

Luisa wrote:

E' Libero che ti sta 'attaccando': se l'attacco è stato bloccato da
ZoneAlarm puoi insegnare al tuo software a non rispondere all'attacco.
Se usi Black Ice programmalo su 'nervous'.
Purtroppo nulla impedisce a libero di mandare dei pacchetti simili a quelli
inviati per la ricerca di trojan virus ai propri clienti.
P

inviati per la ricerca di trojan virus ai propri clienti.
Infatti non credo proprio che lo faccia.
-- 
Bitless <bit...@HotPOPz.com>
 no "z" in the address above

 Infatti non credo proprio che lo faccia.
Mah... guarda cosa mi dice il mio firewall quando mi spiega cos'č successo
quando ho provato a collegarmi al mio account attraverso Tiscalinet:
Summary
     An unusual "IP protocol" was seen. This is something unusual that has a
     number of possible causes.
     Details
     All network traffic on the Internet is carried within IP packets. The
     transmission using IP packets is controlled by a "transport protocol". For
     example, web-surfing (HTTP) and e-mail (POP3, SMTP) applications use
     the TCP protocol to control the transmission (TCP = Transmission
     Control Protocol).
     Since TCP isn't
     appropriate for all
     applications, other
     protocols are
     sometimes used.
     UDP is better suited for multimedia applications, and ICMP is suited to
     network diagnostics.
     TCP, UDP, and ICMP are the most common control protocols used with
     IP. There are a few other well-known ones as well. This alert is
     triggered when our product sees an IP protocol that is not known or
     unusual.
     False Positives
     Some of the protocols are listed as "unknown" by the intrusion detection
     system simply because they are "unusual" or "suspicious". There are
     legitimate reasons to use these protocols, however. Therefore, this alert
     should be considered as a notification that something abnormal is going
     on.
     In many cases, you will want to stop receiving this alert for the one
     peculiar protocol being used in your environment. You can edit the file
     "sigs.ini" in order to avoid seeing this alert in the future. For example,
if
     the protocol in question is number 71, then you can add the line:
     ip.protocol.71 = on
     This will avoid all further alerts from protocol 71.
     You can figure out what protocol is being used looking in the URL of this
     webpage.
  more information
 CERT: CA-99-02-Trojan-Horses
 IP: Protocol field
      A dictionary entry that highlights the protocol field within an IP packet
header.
P.

Sě.
A me risulta essere il router che instrada le connessioni
di un pop Libero di napoli, Na4,  e questa mattina
alle 9.36 quell'IP specifico non era assegnato. Ergo sono
quasi certo che lo scan in questione fosse opera di un
utente in cerca di backdoor. Un fan di Star Trek, aggiungo.
Magari mi sbagliero'... bho?
E' il MAC a lasciarmi perplesso...
Saluti e buone feste a te.
