RE: Interesting development using tcpdump in conjunctionwith SQUID filtering and thiis hostname - bubba.scps.k12.fl.us
"James C Slora Jr" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Organization | PHR+A, pc |
| Message-ID | <[email protected]> |
David McCall wrote Tuesday, January 25, 2005 11:47 AM > The IP for bubba doesn't appear in the untrusted list and after each new > IP the appears in the SQUID list something gets sent to bubba,........ Have you looked through the SQUID logs for the seemingly legitimate queries that bubba is making, corresponding with the new DoS bots and the tcpdump records? Is it just asking for the same page over and over? Is it trying to do something naughty that did not trigger any previous alarms? Florida k12 schools do have overworked security people who go around taking care of problems, and have some experience with botnets etc. A phone call to them might get your problem to the top of their list if there is a strong correlation with the drones or if the k12 host is trying something obviously wrong. _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions