Security Incidents: Re: SNMP Scans

[John <johns () TAMPABAY RR COM>]

I can not remember how long I was seeing RPC scans
from this host and a few others on that net block.
Any attempts to contact anyone, failed. Good luck ;)

Chris Schuler wrote:
> anyone else seeing port 111/rpc scans from this ip?
> 211.185.160.193
> Ive seen at least two walks of my ip address space by this host.
>
> Mar 13 09:45:08 211.185.160.193:4671 -> xxx.xxx.xxx.xxx:111 SYN ******S*
> Mar 13 09:45:08 211.185.160.193:4670 -> xxx.xxx.xxx.xxx:111 SYN ******S*
> Mar 13 09:45:08 211.185.160.193:4672 -> xxx.xxx.xxx.xxx:111 SYN ******S*
> ...
--
The events which transpired five thousand years ago;
Five years ago or five minutes ago, have determined
what will happen five minutes from now; five years
> From now or five thousand years from now.
All history is a current event."

- Dr John Henrik Clake -