BFD Question

[rmbnet]

Just a quick question about BFD, shouldn't BFD do something about this? ... I have APF and BFD installed, but this is not being stopped... any ideas? I get this periodically from random IP's..

**Unmatched Entries**
Illegal user patrick from 210.111.244.62
Illegal user patrick from 210.111.244.62
Illegal user rolo from 210.111.244.62
Illegal user iceuser from 210.111.244.62
Illegal user horde from 210.111.244.62
Illegal user cyrus from 210.111.244.62
Illegal user www from 210.111.244.62
Illegal user wwwrun from 210.111.244.62
Illegal user matt from 210.111.244.62
Illegal user test from 210.111.244.62
Illegal user test from 210.111.244.62
Illegal user test from 210.111.244.62
Illegal user test from 210.111.244.62
Illegal user www-data from 210.111.244.62
Illegal user irc from 210.111.244.62
Illegal user irc from 210.111.244.62
Illegal user jane from 210.111.244.62
Illegal user pamela from 210.111.244.62
Illegal user cosmin from 210.111.244.62
Illegal user cip52 from 210.111.244.62
Illegal user cip51 from 210.111.244.62
Illegal user noc from 210.111.244.62
Illegal user webmaster from 210.111.244.62
Illegal user data from 210.111.244.62
Illegal user user from 210.111.244.62
Illegal user user from 210.111.244.62
Illegal user user from 210.111.244.62
Illegal user web from 210.111.244.62
Illegal user web from 210.111.244.62
Illegal user oracle from 210.111.244.62
Illegal user sybase from 210.111.244.62
Illegal user master from 210.111.244.62
Illegal user account from 210.111.244.62
Illegal user backup from 210.111.244.62
Illegal user server from 210.111.244.62
Illegal user adam from 210.111.244.62
Illegal user alan from 210.111.244.62
Illegal user frank from 210.111.244.62
Illegal user george from 210.111.244.62
Illegal user henry from 210.111.244.62
Illegal user john from 210.111.244.62
Illegal user test from 210.111.244.62
Illegal user test from 221.5.251.160
Illegal user guest from 221.5.251.160

Robert

[cguimont]

Well, how bfd works it that it scans in the logs of the server and try to look for failed connection.
So, if you miss like 4 time the password to get on your server, BFD will ban you from the server.

So all theses random IP's are trying to connect to your box.
When BFD catch them, the Ip is banned from the server, so it cannot access it by anyway afterwards

I hope this helped

Charles