IDC가서 서버에 콘솔을 연결했는데..
 login: 이라는 프로프트 대신..
 Suspect short first fragment.
eth0 PROTO=17 212.15.64.14: 210.112.112.115:0 L=20 S=0x00 I=40960 F=0x4000
T=116
 위와 같은 메세지가 연거푸 나와 있었습니다.
 아이피는 외국 아이피 대역인것 같습니다. (212.15.64.14)
 이곳저곳 뒤져봤는데 보안 관련 로그 같기도 하고..
 다음과 같은 글을 찾았는데..
 ====
Most probably it is not an attack but a scanning of your machine for
services.
  In short technical:
IPv4 uses a feature called fragmentation to permit networks with
different MTUs (that's maximum packet size) to communicate with each
other.
The minimum really used MTU in the internet is about 550 bytes.
If you ever see a first fragment of an IP packet that is less than say
500 bytes it is probably someone trying to split the packets he sends
into small peaces (fragments) so that your filtering software not notice
the real destination of the packet itself. To be effective his/her
attack they need to send a fragment of less than the size of the
transport/session layer header, which in this case is (UDP header=) 8
bytes, So they sent an IP packet fragmented into peaces so that the
first peace carries only the first byte of the udp header, and your
linux kernel noticed that it is not normal to receive a first fragment
so short.
 =====
 영어가 영 딸리네요..
 해석이나 관련된 한글 문서를 좀 볼수 없을까요??
 재미 있는것은 답을 찾으려 다니던중 이와 같은 질문에서 나온 IP는 모두
 C클래스...마지막 IP만 다르더군요..^^:
 우연인지..
 스팸메일서버로 쓰려고 스캐닝 한걸까요??
 답변 부탁 드리겠습니다.
 미리 감사드립니다.