[plug] Crackers!

[John Summerfield]

On Sat, 11 Jul 1998, Terry Porter wrote:

> Hi all,
> Can anyone shed any light on this log? I disconnected from my isp shortly
> afterwards. Does it look like an exploit?
> 
> Jul  7 12:57:04 gronk tcplogd: port 13384 connection attempt from
> root at graft.XCF.Berkeley.EDU
> Jul  7 12:58:01 gronk tcplogd: port 13451 connection attempt from
> unknown at graft.XCF.Berkeley.EDU
> Jul  7 12:58:42 gronk tcplogd: port 13557 connection attempt from
> unknown at graft.XCF.Berkeley.EDU

What's writing these messages? I've just scanned two systems and don't see
any messages containing the string "tcplogd."




Cheers
John Summerfield
http://os2.ami.com.au/os2/ for OS/2 support.
Configuration, networking, combined IBM ftpsites index.