RE: Port scans to UDP 161 (SNMP)

[Max Euston <meuston () jmrodgers com>]

[First off: sorry for the delay in responding, I finally had a long weekend 
off!]

Thanks to all who responded - especially H. Morrow Long 
<morrow.long () yale edu>!!!

It seems that some W-95 machines (specifically laptops?) have HP JetAdmin 
installed incorrectly.  I talked to the owner of the machine and we found 
that the laptop in question had a subnet defined as "205.0.0.0"!  We 
changed this as described in http://web.mit.edu/network/hpfix.  It refers 
to registry entry HKEY_LOCAL_MACHINE/ Software/ HP Jet Admin/ TCPIP (the 
tree from this point down seems to be version dependent, but you can easily 
find it).

Thanks for the help!!!

Max

P.S. I seem to be getting more and more of these scans.  I think that I am 
just going to have to block them without logging them (poor signal/noise 
ratio).

Max
---
Max Euston <meuston () jmrodgers com>