Well, I checked into my ACID yesterday, and there was 109 new alerts! Normally, I get about 5-6 a day, usually robots.txt access. All of the new alerts were of the same type: "(spp_stream4) STEALTH ACTIVITY (FIN scan) detection," and, oddly enough, headed for the same port: 6346(gnutella). So far, there were 114 occurences from 22 different hosts headed to that port. It seems to have tapered off somewhat.

I was wondering if anyone had any thoughts on this activity? Is the RIAA trying to keep track of me, although I haven't used gnutella in 3 months? Or, is this something else? OR, am I just being paranoid?

Ian

Nothing major on the Incidents org report.

Mostly home machines? Over the period of minutes or hours?

I'd be surprised if it's a copyright enforcement agency.

Some new gnutella leech tool perhaps.

Someone who had the ip before you bringing their computer out of suspend
still thinking it has the old ip and trying to open connections to the machines you got FIN's from?

Perhaps some new worm that uses a security hole in a common gnutella client.

Is a home box, the first 100 or so were in 24 hours, the rest came much slower. I've have a static IP for 3-4 months, so it can't be that... Thanks for the suggestions.

Ian