15 Nov
1998
15 Nov
'98
9:41 p.m.
On Sun, Nov 15, 1998 at 06:24:13PM -0500, sigma@pair.com wrote:
Let me guess - the IP is 209.67.50.254, and they're trying to login to nameservers as "root", sometimes a dozen times per second?
Not seeing that rate, but yep: Nov 15 18:10:25 mailhost.cmc.net ipmon[117]: 18:10:24.956040 le0 @35 b 209.67.50.254,1608 -> mailhost.cmc.net,telnet PR tcp len 20 44 -S
Possible to do some TCPDUMPs????? Can you decode the packets and see if there is any source routing or something funny occurring? Tuc/TTSG