Security Incidents mailing list archives
portmap 11/tcp scan every 30 seconds, source port 4435
From: Golden_Eternity <bhodi () BIGFOOT COM>
Date: Tue, 20 Mar 2001 20:15:50 -0800
I've was scanned today exactly every 30 seconds for more than 12 hours. The source port has remined 4435 for every connection and the target was 111/tcp (portmap/sunrpc). I'm guessing that nobody is going to be so bored and anal that they'd do this manually, so its gotta be a scanner. I didn't see any other connections during this time; it limited itself to 111. Does anyone recognize this behavior? Mar 19 21:28:14 roto-router kernel: Packet log: input DENY eth1 PROTO=17 207.175.251.62:4435 255.255.255.255:111 L=84 S=0x00 I=2431 F=0x0000 T=128 (#1) Mar 19 21:28:44 roto-router kernel: Packet log: input DENY eth1 PROTO=17 207.175.251.62:4435 255.255.255.255:111 L=84 S=0x00 I=7807 F=0x0000 T=128 (#1) Mar 19 21:29:14 roto-router kernel: Packet log: input DENY eth1 PROTO=17 207.175.251.62:4435 255.255.255.255:111 L=84 S=0x00 I=9344 F=0x0000 T=128 (#1) Mar 19 21:29:44 roto-router kernel: Packet log: input DENY eth1 PROTO=17 207.175.251.62:4435 255.255.255.255:111 L=84 S=0x00 I=10880 F=0x0000 T=128 (#1)
Current thread:
- portmap 11/tcp scan every 30 seconds, source port 4435 Golden_Eternity (Mar 21)
