<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2802" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hi,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I've found unusual activity where there is an
attempt to authenticate but unsuccesfull due to no entry in
database (LDAP) but there is accounting record for it. Below are the log
& accounting record.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Any comments on this..</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>TQ..</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Fri Oct 21 22:03:06 2005 : Auth: Login incorrect
(rlm_ldap: User not found): [assasaas] (from client 61.6.116.2 port
143)</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Fri Oct 21 22:03:08
2005<BR> Acct-Session-Id =
"0026190D"<BR> Framed-Protocol =
PPP<BR> Framed-IP-Address =
61.6.116.27<BR> User-Name =
"assasaas"<BR> Acct-Authentic =
RADIUS<BR> Acct-Session-Time =
7<BR> Acct-Input-Octets =
762<BR> Acct-Output-Octets =
494<BR> Acct-Input-Packets =
16<BR> Acct-Output-Packets =
15<BR> Acct-Terminate-Cause =
User-Error<BR> Acct-Status-Type =
Stop<BR> Called-Station-Id =
"20878830"<BR> NAS-Port-Type =
Async<BR> NAS-Port =
143<BR> Connect-Info = "28800
V34/V42bis/LAPM"<BR> Service-Type =
Framed-User<BR> NAS-IP-Address =
61.6.116.2<BR> Acct-Delay-Time =
0<BR> Client-IP-Address =
61.6.116.2<BR> Acct-Unique-Session-Id
= "62a6e1512da039e2"<BR>
Stripped-User-Name = "assasaas"<BR>
Realm = "NULL"<BR> Timestamp =
1129903388</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>