Re: Fragmented Packet

Could be anything from a network scan (like nmap or the likes) to
someone attempting to exploit know vulnerabilities. Do you have any
other information, such as destination ports? (Might reveal what they
are after.)

It could also be a script kiddie trying to use a tool they haven't a
clue how to run. Hard to say. Also, by default settings, I'll assume
you've changed the default passwords? =O

--
Peace. ~G


On Tue, 16 Nov 2004 13:59:04 -0600, Joe Grinnell
<joe.grinnell@axisci.com> wrote:
>  
>  
>
> Hi,  I'm pretty new to firewalls and have just installed a SonicWALL Pro230
> with all the default settings.  Anyway, I'm starting to see a lot of
> activity to a few different PC's in my DMZ from the below source.  Anyone
> know what the heck is going on here?  Any help would be very much
> appreciated. 
>
> 11/16/2004 03:05:46.816 - Fragmented Packet Dropped - Source: 83.102.166.24,
> 17, WAN - Destination: XXX.XXX.XXX.XXX, DMZ - Protocol: 17 - 
>
> 11/16/2004 03:08:46.816 - Fragmented Packet Dropped - Source: 83.102.166.53,
> 17, WAN - Destination: XXX.XXX.XXX.XXX, DMZ - Protocol: 17 - 
>
> 11/16/2004 03:16:46.816 - Fragmented Packet Dropped - Source: 83.102.166.84,
> 17, WAN - Destination: XXX.XXX.XXX.XXX, DMZ - Protocol: 17 - 
>
> 11/16/2004 03:23:46.816 - Fragmented Packet Dropped - Source:
> 83.102.166.204, 17, WAN - Destination: XXX.XXX.XXX.XXX, DMZ - Protocol: 17 -
>
> Thanks in advance.  I really need to get my learn on. 
>
> Joe Grinnell
> network security wannabe