RE: Web-based port scanning (fwd)

["John Rumpelein" <jmr () jmrtech com>]

Yashy,

>   I'm not sure how useful a "most common offender" table
> would be. In

It's not "useful" per se, and it says right on my page it's mostly for
entertainment value.  I mostly put it there to see if any of my
competitors (or clients) showed up on it.  As you point out I do get
hit a lot by IRC servers checking if I have an open Wingate proxy.
I've got a whole network of Windows machines behind that server, it's
running ip_masq.

>   I'm curious as to if those ports are all OPEN, or if he just logs
> every port connection attempt. It is odd how there are no

I log every refused connection attempt for ports below 1024.  I don't
block higher than that because it interferes with various things
(notably FTP in non-passive mode).  I don't log connections to open
ports because I don't really care about those.  :)

>   I agree with Fyodor, it would also cause a potential
> "contest", which it
> would be trivial to setup a script, and chew up the admins
> resources.

Yes, it would be.  I would also get quite upset with the person doing
it.

>   Personal logging is a Good Thing [tm], however IMO it
> shouldn't be made
> public.

It's mostly made public so people can see what I've done.  I haven't
had anyone hammer my box because it's there yet.

-J
--
John Rumpelein                              jmr () jmrtech com
Network/Systems Consultant          UNIX & Linux Specialist
Voicemail/Fax: 206.374.2367          http://www.jmrtech.com