NEXT
Make New Entry,
Make Followup Entry
User name brads
Log entry time 09:18:20 on April 24, 2009
Entry number 267814
Followups:
keyword=hatsv3 portserver suffering from a port scan(?)
All (new) telnet connections to the portserver were being refused this
morning. I was able to get in via the web interface and saw that the
connection table was filled with something that made a connection attempt
to every available port but did not complete the transaction. All ports
were listed with status 'Logging in'.
I killed a few connections and was able to get in but I think we're still
being scanned since killed connection slots get filled almost immediately.
Contacted Bob Lukens, he confirmed that hatsv3 had /not/ been on the
security scan exclusion list (it is now). There are other independent
"Inventory" scans that might be causing this mornings problem though --
he's looking into it.