Re: Port scans to UDP 161 (SNMP)

[Michael <mike () westphila net>]

On Thu, 21 May 1998, Max Euston wrote:

[>      Has anyone seen this before?  I have been getting UDP (161/SNMP) port 
[>scans across my 205.247.224/24 (from .255 to .[012]?) repeatedly from 
[>certain IP #s.  The most recent events happened 6 times over the past 5 
[>days (all from the same IP).  The user of that IP has a laptop w/ 
[>Win-95(B?) running FrontPage-98 and IE-4.01; they also have 
[>AOL-(something), Office-97, Outlook-98, Project-98.  Although they use DHCP 
[>(in a Win-95/Win-NT shop), it seems that this machine has always gotten the 
[>same IP#.  The user seems to have been using the machine during each scan. 
[> The UDP source port seems to stay in the range 1030-1035 (for this and 
[>previous scans from other locations).  I don't have a dump of the incomming 
[>packets, just a log that they were dropped.

I've seen this before, last year, from a couple of different
sites.  It seems that someone misconfigured some sort
of monitoring software (their ip block was a couple numbers
off from our address class).  I vaguely rememeber talking to the
admin in one of the cases, his reply is below.



_M.



 From jledbetter () actware com  Wed Oct  8 21:22:19 1997
Received: from act_server.actware.com (act.actware.com [208.130.99.4])
        by lifted.rapiddata.com (8.8.5/8.8.5) with ESMTP id VAA25347;
        Wed, 8 Oct 1997 21:22:18 -0400 (EDT)
Received: by act.ACTWARE.com with Internet Mail Service (5.0.1458.49)
        id <41SV5SSF>; Wed, 8 Oct 1997 21:21:24 -0400
Message-ID: <31BBCF704DFBD011AD5B006097585B47386B4A () act ACTWARE com>
From: Jason Ledbetter <jledbetter () actware com>
To: "'Michael'" <mike () lifted rapiddata com>, jledbetter () actware com,
        sburton () actware com
Cc: "( Gurus )" <gurus () lifted rapiddata com>
Subject: RE: Forwarded mail....
Date: Wed, 8 Oct 1997 21:21:23 -0400
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
X-UID: 287
Status: RO
X-Status: A

Michael,

        I aplogize for taking so long to reply to your email. In short,
we had some weird stuff going on here and I have firewalled outbound
SNMP. I do aplogize for any inconvienes it may have caused.

Jason Ledbetter
Network Technical Specialist
Applied Computer Technologies




+- Michael_Jastremski_mike@westphila.net_http://westphila.net/mike -+
|                                                                   | 
 \____Digital_Photography_Experiment_http://images.westphila.net___/