6 Oct
2003
6 Oct
'03
12:30 a.m.
On Mon, 06 Oct 2003 00:12:07 EDT, Robert Boyle <robert@tellurian.com> said:
What gets me is the moron admins who track down every "attack" they see. "Attacks" such as ICMP echo requests, Port 80 connections, etc. If they get huge logs that's one thing, but for four pings from a windows box or a mistyped IP address in a URL and they are worried about our "attack" These bogus reports outnumber legitimate complaints 4:1.
My favorite: "ntp-1.vt.edu is portscanning me very slowly with source port 123...." The really sad ones are the ones who 3 days earlier dropped me a note to tell me they'll using our NTP server.....