[OpenAFS] Port probing our AFS cell...
Derrick J Brashear
Tue, 6 Sep 2005 13:40:04 -0400 (EDT)
On Tue, 6 Sep 2005, Rodney M Dyer wrote:
> We are checking into possible probing (hacking) attempts on our AFS file
> servers. We are seeing one address (184.108.40.206) that our fileserver needs
> to perform a callback on and it fails. The problem is that it seems to fail
> on port numbers that are increasing by 12 each time. The following logs show
> this "probing"...
And why do you think it's a hack attempt and not a crappy nat?
> We've also seen our BOS process die leaving strange last-write-times on some
> of the logs. Notice the date on the core, BosLog, and VolserLog files:
Well, that is strange
> -rw-r--r-- 1 root root 124 Dec 30 1967 BosLog
> Does this at all look like something out of the ordinary to any of you?
what's the backtrace in the core?