RE: [cobalt-security] Need some help on a Attack Alert and a response from the source please...

["Chuck Lewis" <clewis@xxxxxxxxxx>]

On Tue, 10 Feb 2004, netcat wrote:

>looks like your portsentry got it handled fine, and you are not really
>running an insecure proxy anyway, are you? so do nothing. and if they
>continue, technically you should complain to their upstream. which most
>probably will not help, considering where they are located.

Thanks. And I agree (about the upstream reporting) :-)

But what does:

" It seems somebody in our network have SOCKS proxy configured with your
host"

mean to you ? Is this just a diversion or what ?

>if you have a hard time making sense of your firewall logs,
>
>http://www.robertgraham.com/pubs/firewall-seen.html is a pretty good
>reference for starters and recommended reading.

GREAT - thanks !



Chuck