ipchains vsv portsentry (Was: Attack Alert)

[Gustav Schaffter <gustav schaffter com>]

Chuck,

I've seen lots of talk about portsentry.

I have setup my ipchains so that any incomming traffic that is not
explicitly ACCEPT'ed will in the last ppp rule be quietly DENY'ed.
And logged.

Please, enlighten me to what advantage portsentry would give over the
ipchains logging in this matter.

Best regards
Gustav

On Sun, 31 Oct 1999, Chuck Mead wrote:
> A bit odd this one... it's been happening for several days now from the same
> source... they're hitting port 0 ????? Weird...
> 
> Oct 30 23:15:12 server portsentry[440]: attackalert: Unknown Type: Packet
> Flags: SYN: 0 FIN: 0 ACK: 0 PSH:
> 1 URG: 1 RST: 0 from host: punt-10.mail.demon.net/194.217.242.35 to TCP
> port: 0
> Oct 30 23:15:12 server portsentry[440]: attackalert: Host:
> punt-10.mail.demon.net/194.217.242.35 is already
> blocked Ignoring
> 
> -- 
> Chuck Mead, CTO, MoonGroup Consulting, Inc. <http://moongroup.com> 
> Mail problems? Send "s-u-b-s-c-r-i-b-e mailhelp" (no quotes and no
> hyphens) in the body of a message to mailhelp-request moongroup com 
> Public key available at: wwwkeys.us.pgp.net                              
> 
> 
> -- 
> To unsubscribe: mail redhat-list-request redhat com with "unsubscribe"
> as the Subject.
-- 
JFK, assassination plot, sex, money laundering, blackmail, hacking, security, encryption, bomb, CIA, NSA, KGB, Russia, Lockerbie, terrorism, child abuse, drug dealing, espionage.

pgp = Pretty Good Privacy

http://www.schaffter.com