In this article, Noel talks about how to determine if what's happened is an attack, or a misunderstanding. "The phone rings or an email comes in and someone tells you that they have reason to believe that your box or boxes have been cracked. Do you believe it? Is it true? What do you do next? What should you not do? This is the situation any System Administrator can find ourselves in. After all anyone can get these calls and emails. I got a call last month that someone was being attacked from a mail server. It turned out that it was not an attack it was an identd query that was being misunderstood. But some times the call is for real."
News: Host Security
