R: correlation between porscans and local activity

> There now appears to be some coincidence between the times my family
> does web browsing and when I get scanned for port 1080.

Someone is probably trying to understand wether or not your is an open SOCKS
firewall they can use. I could bet these scans occur during IRC sessions
from one of your windows boxes (check if in the logs you have outgoing
traffic towards a 666X port).

Scanning IPs on IRC channels to check for open SOCKS it's a rather common
thing hackers-wanna-be love to do, since it leads to huge lists of addresses
they can trade, share and sell to other script kiddies around.

Just my bit of info,
Raist
Received on Jan 05 2000