Port scanning or hack attemp?

[fs483]

Hello,

I have syslog activated on one of my ASA and I got a heck of lot of warnings by email with the following message :

%ASA-3-713902: IP = , Removing peer from peer table failed, no match!

I traced the IP to a datacenter in the US. What does that cryptic message mean? Was someone trying to enter my systems?

Thanks
fs483

 

[fs483]

Oh, one thing, just to avoid problems. I added an ACL to deny that IP for now.

 

[VinceWhirlwind]

It's the NSA. They're onto you. Better burn everything and flee.

 

[Supergrrover]

It could be a lot of things. Spoofing to the data center, they could have a vpn misconfiguration on their side, etc. A skilled hacker would be a lot more stealthy than that. Script kiddies are one thing but breaking a vpn takes a bit more. See if you can track down who owns that ip and send them a message.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[fs483]

Same IP that is hitting my firewall. Here's more info :

<163>Aug 04 2009 18:11:57 ASA5510-xxxx : %ASA-3-713048: IP = 69.84.133.36, Error processing payload: Payload ID: 1

What does that error mean?

 

[VinceWhirlwind]

Is your SMTP receiving service located inside your FW?

Those logged lines could a result of your SMTP server dropping incoming SMTP connections while 69.84.133.36 thinks it still has an active connection.

I wouldn't necessarily block that IP address from your firewall unless you are absolutely sure you don't need to send/receive mail with this company and all its customers.

RESULT: 69.84.133.36
Banner: 220 mail.denovotechnology.com ESMTP (e313aa10c2868bac9073297fa33a8d6e)
Connect Time: 0 seconds - Good
Transaction Time: 0.375 seconds - Good
Relay Check: OK - This server is not an open relay.
Rev DNS Check: OK - 69.84.133.36 resolves to mail.denovotechnology.com
GeoCode Info: Geocoding server is unavailable
Session Transcript: HELO please-read-policy.mxtoolbox.com
250 mail.denovotechnology.com Hello mxtb-pws1.mxtoolbox.com [64.20.227.131], pleased to meet y [62 ms]
MAIL FROM: <test@mxtoolbox.com>
250 [62 ms]
RCPT TO: <test@mxtoolbox.com>
550 No such domain at this location (test@mxtoolbox.co [188 ms]
QUIT
221 B [62 ms]