Re: [LOGS] Summary of large-scale portscanning detects

They're for correlation.  There used to be several of us who did similar 
things on a(n almost) daily basis.  I'm the only one left.  They're 
purposely marked with [LOGS] in the subject so you have something easy 
to filter on if they bore and/or annoy you.

As to the missing m$ ports, there are so #%^#$#@ many of them that I 
have been forced to drop packets destined for TCP 135 and 445 outside 
the sensor.

- ken

Merton Campbell Crockett wrote:

>My apologies to the list but I don't understand the significance of this
>summary.  It's normal to have systems sweeping through your address space
>turning the door handle to see if its unlocked.
>
>The first block in Sunday's report is, perhaps, the only thing of interest
>in the report.  Unfortunately, the report format doesn't allow us to see
>a complete set of probes targeted at an individual system.
>
>Another curiousity question is why Microsoft RPC/CIFS ports are missing.  
>Looking at my own logs, probes to port 1433 are always paired with probes
>to port 445.
>
>Merton Campbell Crockett
>
>
>
>On Sun, 15 Aug 2004 [email protected] wrote:
>
>  
>
>>The following extracts show the beginning and ending of scan activity
>>was detected on my network.  The number following each set is the total
>>number of probes for that source.  Timestamps are GMT-0500.
>>
>>Aug 14 01:02:10 212.90.254.234:3627 -> xxx.yyy.1.1:21 SYN ******S* 
>>Aug 14 01:02:09 212.90.254.234:3628 -> xxx.yyy.1.1:80 SYN ******S* 
>>Aug 14 01:02:10 212.90.254.234:3629 -> xxx.yyy.1.1:53 SYN ******S* 
>>Aug 14 01:02:10 212.90.254.234:3630 -> xxx.yyy.1.1:25 SYN ******S* 
>>Aug 14 01:02:09 212.90.254.234:3631 -> xxx.yyy.1.1:79 SYN ******S* 
>>Aug 14 01:02:07 212.90.254.234:3632 -> xxx.yyy.1.1:23 SYN ******S* 
>>Aug 14 01:02:07 212.90.254.234:3633 -> xxx.yyy.1.1:110 SYN ******S* 
>>Aug 14 01:02:10 212.90.254.234:3634 -> xxx.yyy.1.1:1433 SYN ******S* 
>>[...]
>>Aug 14 03:02:02 212.90.254.234:4753 -> xxx.yyy.255.254:80 SYN ******S* 
>>Aug 14 03:02:02 212.90.254.234:4752 -> xxx.yyy.255.254:21 SYN ******S* 
>>Aug 14 03:02:02 212.90.254.234:4758 -> xxx.yyy.255.254:79 SYN ******S* 
>>Aug 14 03:02:02 212.90.254.234:4760 -> xxx.yyy.255.254:110 SYN ******S* 
>>Aug 14 03:02:02 212.90.254.234:4756 -> xxx.yyy.255.254:53 SYN ******S* 
>>Aug 14 03:02:02 212.90.254.234:4757 -> xxx.yyy.255.254:25 SYN ******S* 
>>Aug 14 03:02:02 212.90.254.234:4759 -> xxx.yyy.255.254:23 SYN ******S* 
>>Aug 14 03:02:02 212.90.254.234:4767 -> xxx.yyy.255.254:3389 SYN ******S* 
>>710292
>>    
>>
> 
>
>  
>

-- 
- Ken
=================================================================
Ken Connelly Systems and Operations Manager, ITS Network Services
University of Northern Iowa           Cedar Falls, IA  50614-0121
email: [email protected]
phone: (319) 273-5850   fax: (319) 273-7373

It's much more important to know what you don't know than what you do know!


_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions