Re: Strange scans - inquisitive question

[Valdis.Kletnieks () VT EDU (Valdis Kletnieks)]

On Fri, 09 Jun 2000 10:46:21 BST, Paul Rogers <paul.rogers () MIS-CDS COM>  said:
> Last night we received some strange scans with a source port of 21 (ftp) and
> a destination port of 7 (echo). The destination address was always the
> network address. I was just wondering if anyone else had seen these scans or
> whether anyone knew what they were looking for. The scans were performed
> over TCP (protocol 6) and UDP (protocol 17).

Well.. the destination port 7 (echo) over TCP and UDP is pretty
obviously just scanning your net looking to see what machines answer.

Why source of 21?  To fool firewalls into thinking that it's an
FTP connection, and that the packet in question is a return packet
for something you sent to their well-known-port.

Yes, that only works for TCP, since FTP doesn't run over UDP,
but there's probably enough firewalls out there that blindly
allow port 21 traffic without further sanity checking that using 21
as the source port is A Big Win for the scanner...

                                Valdis Kletnieks
                                Operating Systems Analyst
                                Virginia Tech