[OpenAFS] Port probing our AFS cell...

[Derrick J Brashear]

On Tue, 6 Sep 2005, Rodney M Dyer wrote:

> We are checking into possible probing (hacking) attempts on our AFS file 
> servers.  We are seeing one address (24.74.66.175) that our fileserver needs 
> to perform a callback on and it fails.  The problem is that it seems to fail 
> on port numbers that are increasing by 12 each time.  The following logs show 
> this "probing"...

And why do you think it's a hack attempt and not a crappy nat?

> We've also seen our BOS process die leaving strange last-write-times on some 
> of the logs.  Notice the date on the core, BosLog, and VolserLog files:

Well, that is strange

>     -rw-r--r--   1 root     root         124 Dec 30  1967 BosLog


> Does this at all look like something out of the ordinary to any of you?

what's the backtrace in the core?