Linux

Ask something
Discussion Locked

ftp request to a Linux box every 5 min.

0 helpful
7 replies

by iamsanchez

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

A windows 2000 box is issuing ftp requests to a linux box every five minutes. Where's it coming from? How do I stop it?

One entry from /var/log/secure log file on the linux server. The IP address XXX.XXX.XXX.XXX corresponds to the W2K system in question.

Jul 24 13:54:42 linuxbox xinetd[607]: START: ftp pid=2541 from=XXX.XXX.XXX.XXX
Jul 24 13:54:43 arial xinetd[607]: EXIT: ftp pid=2541 duration=1(sec)

Any ideas?
Rafael.

7 replies

by cpfeiffe

The windows box is issuing the request, obviously. If it is every five minutes like clockwork then there must be a scheduled job on the W2K box to issue an FTP. You should be able to stop it there. There may also be some kind of network vulnerability scanner (like SARA) or network monitor (like OVIS) that is doing this from the W2K box. Look at the services that are running and see if anything doesn't look right.

by steve cody

It sounds like it is something like WhatsUP Gold, or some service monitor that is checking to make sure the FTP service is running on that machine. Check out the W2K computer in question and see if it's running some of the software I mentioned.

Steve

by lintadsl

Add one more thought;
If you don't find any from Win2k, using either IPTABELS or IPCHAINS, to drop port 21 from the win2k IP address.
Hope you find some thing.
- Lintadsl

This discussion is closed to new replies.