Security Incidents mailing list archives

just how much sunrpc scanning is normal?


From: jburdge () AVENTAIL COM (Jon Burdge)
Date: Thu, 24 Feb 2000 16:07:29 -0800


I've been seeing a lot of scanning on my machines for open sunrpc ports.  I
always try to notify the admin of the machine that scanned me, as it's been
my experience it's usually just a staging point for some script kitty.  The
reason I'm writing this is I'd like to know..is this amount of activity
normal?  Here's the logs from one of my machines.  This isn't a high profile
site or anything.

Dec 16 17:22:28 sol tcplogd[458]: sunrpc connection from
@mangle.atsi.net:758
Dec 25 20:07:33 sol tcplogd[12185]: sunrpc connection from
38.193.155.121:16541
Jan  1 17:49:49 sol tcplogd[3386]: sunrpc connection from
turbo.rdb.co.jp:2666
Jan  4 12:34:02 sol tcplogd[7061]: sunrpc connection from @210.107.65.65:955
Jan 27 08:56:39 sol tcplogd[13530]: sunrpc connection from
cx674799-a.irvn1.occa.home.com:2488
Feb  6 14:02:02 sol tcplogd[2262]: sunrpc connection from
@211.40.176.241:871
Feb  8 20:49:27 sol tcplogd[4843]: sunrpc connection from @209.24.82.10:753
Feb 13 03:08:21 sol tcplogd[9229]: sunrpc connection from
ms3.riverview.net:852
Feb 16 09:55:00 sol tcplogd[1034]: sunrpc connection from
@dns.sumitomo-fh.co.jp:31391
Feb 20 23:02:55 sol tcplogd[10300]: sunrpc connection from
@www.4quest.com:884

Is it just I never realized how common this scanning was?  Is this a feature
of some automated scanning/exploitation script out there?

jlb.


Current thread: