请问，这怎么回事？被攻击了吗？

gary.chen

请问，这怎么回事？攻击？
Sep 10 17:05:02 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 331
Sep 10 17:05:02 rosettanet in.ftpd[17139]: [ID 337738 daemon.debug] Password required for test.
Sep 10 17:05:02 rosettanet in.ftpd[17139]: [ID 416587 daemon.debug] command: PASS <passwd>
Sep 10 17:05:02 rosettanet in.ftpd[17139]: [ID 427203 daemon.debug] pam_authenticate: error Authentication failed
Sep 10 17:05:02 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 530
Sep 10 17:05:02 rosettanet in.ftpd[17139]: [ID 673059 daemon.debug] Login incorrect.
Sep 10 17:05:05 rosettanet in.ftpd[17139]: [ID 577562 daemon.debug] command: USER test
Sep 10 17:05:05 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 331
Sep 10 17:05:05 rosettanet in.ftpd[17139]: [ID 337738 daemon.debug] Password required for test.
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 416587 daemon.debug] command: PASS <passwd>
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 427203 daemon.debug] pam_authenticate: error Authentication failed
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 530
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 673059 daemon.debug] Login incorrect.
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 577562 daemon.debug] command: USER test
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 331
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 337738 daemon.debug] Password required for test.
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 416587 daemon.debug] command: PASS <passwd>
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 427203 daemon.debug] pam_authenticate: error Authentication failed
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 530
Sep 10 17:05:08 rosettanet in.ftpd[17139]: [ID 673059 daemon.debug] Login incorrect.
Sep 10 17:05:09 rosettanet in.ftpd[17139]: [ID 577562 daemon.debug] command: USER test
Sep 10 17:05:09 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 331
Sep 10 17:05:09 rosettanet in.ftpd[17139]: [ID 337738 daemon.debug] Password required for test.
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 416587 daemon.debug] command: PASS <passwd>
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 427203 daemon.debug] pam_authenticate: error Authentication failed
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 530
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 673059 daemon.debug] Login incorrect.
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 577562 daemon.debug] command: USER test
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 331
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 337738 daemon.debug] Password required for test.
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 416587 daemon.debug] command: PASS <passwd>
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 427203 daemon.debug] pam_authenticate: error Authentication failed
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 530
Sep 10 17:05:10 rosettanet in.ftpd[17139]: [ID 673059 daemon.debug] Login incorrect.
Sep 10 17:05:11 rosettanet in.ftpd[17139]: [ID 577562 daemon.debug] command: USER test
Sep 10 17:05:11 rosettanet in.ftpd[17139]: [ID 988435 daemon.debug] <--- 331
Sep 10 17:05:11 rosettanet in.ftpd[17139]: [ID 337738 daemon.debug] Password required for test.

风之幻想

有人在ftp,用snoop看看是不是自己人在用.

gary.chen

snoop？能不能举个例子，就是查谁用ftp登录我的服务器。

饮鸩止渴

netstat -an 看看established的连接就知道了