Re: [tlug] hack attack from localhost?

[Christopher SEKIYA <wileyc@example.com>]

On Thu, Jan 31, 2002 at 11:20:44PM +0900, Sven Simon wrote:

> Jan 27 03:06:04 hostname /kernel: Jan 27 03:06:04 ninja /kernel: 
> Connection attempt to UDP 127.0.0.1:512 from 127.0.0.1:3980
> 
> As I recall port 512 has something to do with mail notification

yertle:~$ grep 512 /etc/services
biff            512/udp         comsat          # Biff the dog

You wouldn't happen to have logged in at 03:06?

-- Chris