ftp server check?

[BruceLee]

Just to make sure I understand this log entries correctly.
Someone knocked at my ftp server to receive the ftp server version via the "welcome" response!
Is this correct?
Thanks

Jan 4 04:37:23 servername xinetd[20809]: START: ftp pid=15919 from=219.148.33.74
Jan 4 04:37:23 servername proftpd[15919]: xxx.xxx.xxx.xxx (219.148.33.74[219.148.33.74]) - FTP session opened.
Jan 4 04:37:24 servername proftpd[15919]: xxx.xxx.xxx.xxx (219.148.33.74[219.148.33.74]) - FTP session closed.
Jan 4 04:37:24 servername xinetd[20809]: EXIT: ftp status=0 pid=15919 duration=1(sec)

[scott]

exactly, something connected for no more than a second

[BruceLee]

thanks, it connected but did not login, right?
otherwise login would have been logged too as I know.

Thanks

[scott]

right, it might have been as simple as a syn packet hitting that port. Nothing interactive happened. Maybe a recon

[BruceLee]

thank you