Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've set up psad 2.1.5-3 in Ubuntu 10.10. I keep receiving emails like this

=-=-=-=-=-=-=-=-=-=-=-= Wed Oct 19 17:26:57 2011 =-=-=-=-=-=-=-=-=-=-=-=

        Danger level: [4] (out of 5)

   Scanned UDP ports: [17500: 1 packets, Nmap: -sU]
      iptables chain: INPUT, 1 packets

              Source: XXX.XXX.215.132
                 DNS: [No reverse dns info available]

                 DNS: [No reverse dns info available]

  Overall scan start: Mon Oct 17 12:14:31 2011
  Total email alerts: 2256
  Complete UDP range: [67-17500]
     Syslog hostname: XXXX

        Global stats: chain:   interface:   TCP:   UDP:   ICMP:
                      INPUT    eth0         0      4544   0

[+] Whois Information:
% [whois.apnic.net node-5]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum: -
netname:      ERX-NETBLOCK
descr:        Early registration addresses
remarks:      ------------------------------------------------------
remarks:      Important:
remarks:      Networks in this range were allocated by InterNIC
remarks:      prior to the formation of Regional Internet
remarks:      Registries (RIRs): AfriNIC, APNIC, ARIN, LACNIC and RIPE NCC.
remarks:      Address ranges from this historical space have now
remarks:      been transferred to the appropriate RIR database.remarks:
remarks:      If your search has returned this record, it means the
remarks:      address range is not administered by APNIC.
remarks:      Instead, please search one of the following databases:
remarks:      - AfriNIC (Africa)
remarks:      website: http://www.afrinic.net/
remarks:      command line: whois.afrinic.net
remarks:      - ARIN (Northern America)
remarks:      website: http://www.arin.net/
remarks:      command line: whois.arin.net
remarks:      - LACNIC (Latin America and the Carribean)
remarks:      website: http://www.lacnic.net/
remarks:      command line: whois.lacnic.net
remarks:      - RIPE NCC (Europe)
remarks:      website: http://www.ripe.net/
remarks:      command line: whois.ripe.net
remarks:      For information on the Early Registration Transfer
remarks:      (ERX) project, see:
remarks:      http://www.apnic.net/db/erx
remarks:      ------------------------------------------------------
country:      AU
admin-c:      IANA1-AP
tech-c:       IANA1-AP
mnt-by:       APNIC-HM
mnt-lower:    APNIC-HM
changed:      hm-changed@apnic.net 20030404
changed:      hm-changed@apnic.net 20040926
changed:      hm-changed@apnic.net 20070214
source:       APNIC

role:           Internet Assigned Numbers Authority
address:        see http://www.iana.org.
e-mail:         nobody@apnic.net
admin-c:        IANA1-AP
tech-c:         IANA1-AP
nic-hdl:        IANA1-AP
remarks:        For more information on IANA services
remarks:        go to IANA web site at http://www.iana.org.
mnt-by:         MAINT-APNIC-AP
changed:        helpdesk@apnic.net 20110811
source:         APNIC

=-=-=-=-=-=-=-=-=-=-=-= Wed Oct 19 17:26:57 2011 =-=-=-=-=-=-=-=-=-=-=-=

My ip is XXX.XXX.215.84, and attacker (?) is XXX.XXX.215.132 Also, according to mail destination of the attack is or XXX.XXX.215.255, which is a broadcast address.

Any ideas of what is going on? Is this host actually an attacker? Or psad triggers a false alarm?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.