With this message I'm sure to unleash a maelstrom of critisism, but here goes anyway. I have a RH6.2 machine hooked up on the internet. It's pretty much configured out of the box, no patches. I received the following e-mail from a user on another system: >This is a notice of abuse by one of your subscribers/users. The following >information describes the intrusion of my system: > >Date of incident: 7-19-01 >Time of incident: 10:00:02AM (Arizona time) >Type of incident: DNS PORT PROBE >IP address of offending user: X.X.X.X* >Name of offending users computer (If known):UNKNOWN >Port(s) which was/were intruded upon:53 >Resolved address of offending user: X.X.com* >IP address of intruded user (My computer): 24.21.118.88 > >Please keep me aprised of any actions taken against this offender. I find >this matter to be serious and would appreciate something being done in an >expedient manner. * - Address removed for obvious reasons. My question is, what is a DNS PORT PROBE? Does that just mean that a program requested service of his computer on port number 53? If so, what's so wrong with that? Also, does the fact that this request came from my computer mean someone has broken in and is attempting connections from my computer? Thanks, Seth -- Seth Bernsen V-CPU Engineer Innoveda, Inc. Phone: 651-765-2252 Fax: 651-765-2205 http://www.innoveda.com