Can you clarify what interfaces they are? inside, dmz, ?Satya

Peter,you could do a no in front of those commands to remove them. There is a GUI interface if you like it -- PDM I think...Satya

Hi Patrick,Where do they login into? I assume your FTP server, right? What do you guys have? - plain ftp? or sftp? or ftps?Satya

I think you can control it buy controlling the routes. Assuming you also have a CSM or ACE, you cn control the traffic as which module it should it - either FWSM or CSM. I don't have the configs, but I think it is possible.But I am with Jon in saying...

Yeah I know. You can use the inspection (IOS world - you can use CBAC or tcp intercept) to limit the embryonic connections, so that you can protect yourself. But for the quick mitigation, just block that range, so that it discourages the attacker and...