Am I being hacked?

[Matthew Geier]

>   3) Am I being hacked?
> 	by Tim Winders <twinders at SPC.cc.tx.us>

> I am seeing a BUNCH of these type of messages in my log.nmb file.  the IP
> address varies, with only 2 different ones showing up.

 Only 2? :-)


> process_node_status_request: status request for name *<00> from IP 206.139.7.109
>  on subnet REMOTE_BROADCAST_SUBNET - name not found.
 
 I get these all the time, from a wide varity of source addresses,
some may be our own people (with laptops) on the move, but I imagine
most are 'hackers' looking for NT/Win95 box with a writable share.

 My site get probed all the time. Just the last week some one probed
every IP address looking for IMAP servers.


-- 
Matthew Geier,                          matthew at law.usyd.edu.au
Computer Systems Manager,               +61 2 9351 0240
Law School, University of Sydney        +61 2 9351 0200 (fax)