Security Incidents mailing list archives
port scans from local workstation
From: "Infrastructure Dept." <infrastructure () narellan net>
Date: Wed, 13 Sep 2000 16:27:32 -0400
Hello all,
recently I have notice scanlogd entries in my logs regarding port scans
from one of my local NT workstations. The scans seem very very random in the
sense that it happens during random times of the day and scans random ports.
Any Ideas??? I have checked the NT machine for Trojans and virus and have
come up clean. There is nothing running that should be doing this and it
just started about a month ago. I have also see scans from other local
address just like this. What do the flags mean?
Sep 12 10:03:25 ns1 scanlogd: From 206.230.66.33 to 206.230.66.1 ports 6128,
11141, 58831, 27971, 52226, 5659, 14038, 43201, 1448, ..., flags ??rp?u, TOS
00, TTL 127, started at 10:03:22
Sep 12 10:06:12 ns1 scanlogd: From 206.230.66.33 to 206.230.66.1 ports
48304, 19426, 42529, 29523, 10424, 36966, 16945, 16241, 33534, ..., flags
??rp?u, TOS 00, TTL 127, started at 10:06:09
Sep 12 10:11:29 ns1 scanlogd: From 206.230.66.33 to 206.230.66.1 ports
44470, 35365, 26432, 39092, 49494, 1132, 12944, 46776, 60720, ..., flags
??rp?u, TOS 00, TTL 127, started at 10:11:25
Sep 12 10:11:54 ns1 scanlogd: From 206.230.66.33 to 206.230.66.1 ports
65176, 1221, 56007, 27880, 26289, 55399, 46897, 22289, 49478, ..., flags
??rp?u, TOS 00, TTL 127, started at 10:11:51
Sep 12 14:08:32 ns1 scanlogd: From 206.230.66.33 to 206.230.66.1 ports
41453, 18023, 19477, 45206, 17338, 40639, 9148, 23265, 7106, ..., flags
??rp?u, TOS 00, TTL 127, started at 14:08:30
Sep 12 14:10:07 ns1 scanlogd: From 206.230.66.33 to 206.230.66.1 ports
21420, 7166, 58711, 44823, 2003, 14019, 2892, 28028, 32867, ..., flags
??rp?u, TOS 00, TTL 127, started at 14:10:04
Sep 13 13:43:21 ns1 scanlogd: From 206.230.66.33 to 206.230.66.1 ports
59455, 34793, 18180, 29239, 8763, 18227, 55163, 12362, 35229, ..., flags
??rp?u, TOS 00, TTL 127, started at 13:43:17
Sep 13 13:44:03 ns1 scanlogd: From 206.230.66.33 to 206.230.66.1 ports 7218,
53623, 12287, 46176, 9642, 3254, 8367, 58647, 2701, ..., flags ??rp?u, TOS
00, TTL 127, started at 13:43:58
Sep 13 13:45:12 ns1 scanlogd: From 206.230.66.33 to 206.230.66.1 ports 4149,
20740, 45087, 3854, 26892, 50031, 8281, 40896, 34913, ..., flags ??rp?u, TOS
00, TTL 127, started at 13:45:06
Sep 13 13:46:11 ns1 scanlogd: From 206.230.66.33 to 206.230.66.1 ports
45328, 11275, 3902, 37930, 57318, 27430, 12629, 45531, 44883, ..., flags
??rp?u, TOS 00, TTL 127, started at 13:46:08
Mr. I.
Network Engineer / Ops Manager
Narellan (NorthEast) Inc.
Current thread:
- port scans from local workstation Infrastructure Dept. (Sep 13)
- <Possible follow-ups>
- port scans from local workstation Infrastructure Dept. (Sep 14)
- Re: port scans from local workstation Fernando Cardoso (Sep 14)
- Re: port scans from local workstation Bill Royds (Sep 14)
