Security Incidents: Port 65535

[Mike.Murray () UTORONTO CA (Murray, Mike)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hey all...

        Been watching a rather strange scan of our Class C for the past week; I
don't know if I'd even call it a scan.  Perhaps a misconfigured machine, or
something?  Here's a log snippet:
Feb 29 07:12:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=15817 F=0x00B8 T=47
(#7)
Feb 29 07:14:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16104 F=0x00B8 T=47
(#7)
Feb 29 07:16:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16310 F=0x00B8 T=47
(#7)
Feb 29 07:18:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16430 F=0x00B8 T=47
(#7)
Feb 29 07:20:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16564 F=0x00B8 T=47
(#7)
Feb 29 07:22:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16767 F=0x00B8 T=47
(#7)
Feb 29 07:24:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=17015 F=0x00B8 T=47
(#7)
Feb 29 07:26:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=17227 F=0x00B8 T=47
(#7)

        I'm denying all of them at the firewall.  I'm rather curious as to what
it is, though.  The source is a machine in Israel, and, as of yesterday, the
scans were continuing on an intermittent basis.  When it's happening, it sends
out a packet to our machine exactly every two minutes.

        Anybody have any idea on this one?

                                                Mike

- ----------------------------------
Message sent on 02-Mar-00 at 15:54:35

Mike Murray
Apt 1402
666 Spadina Ave
Toronto, ON
M5S 2H8

Phone: (416) 323-3160

        I can't think of anything pithy to say at
        all, today.  So, I ramble.
- ----------------------------------

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.2

iQA/AwUBOL7VD4DBZTHOsqLmEQJNJACfagI24fOLNIjiyH8sRQ9VhUdGqU0AoPwa
mTR4DMdfuEIC9q30UubUW6L6
=wG8B
-----END PGP SIGNATURE-----