Re: Port Scanning on 1026 & 1027

That's why we have tools like GFI Languard and NetScanTools.

If you truly are worried about this port scanning, just run a sniffer like
Ethereal and see what's actually happening. Could be nothing, could be
something.

Good luck.


Cheers,

Dan Parmelee 

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Smith, Donald
Sent: Thursday, July 28, 2005 10:58 AM
To: Intrusions List (GCIA Practicals); Intrusions List (GCIA Practicals)
Subject: Re: [Intrusions] Port Scanning on 1026 & 1027

I believe your correct re: xpsp2 but there are TONS of other windows systems
out there.
Old exploits continue to be used because they work:)
 
 
[email protected] giac

________________________________

From: [email protected] on behalf of Dan Parmelee
Sent: Wed 7/27/2005 5:05 PM
To: 'Intrusions List (GCIA Practicals)'
Subject: Re: [Intrusions] Port Scanning on 1026 & 1027



If I recall correctly, the Messenger service is disabled by default in XP
SP2 so why are they even wasting their time? I still stand by my
"MessengerDisable" utility.


Cheers,

Dan Parmelee

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Smith, Donald
Sent: Wednesday, July 27, 2005 2:02 PM
To: Intrusions List (GCIA Practicals)
Subject: Re: [Intrusions] Port Scanning on 1026 & 1027

An increase in scanning on those ports is noticeable here.
http://isc.sans.org/port_details.php?port=1026
http://isc.sans.org/port_details.php?port=1027

Its not a huge increase but has an upward trend.


[email protected] giac

> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of Tony Tomasello
> Sent: Tuesday, July 26, 2005 1:15 PM
> To: [email protected]
> Subject: [Intrusions] Port Scanning on 1026 & 1027
>
>
> Guys,
>
> I have noticed a tremendous amount of scanning on ports 1026 and 1027.
> Not sure if you all have been experiencing the same. Is this something 
> that I should be concerned about ?
>
> Thanks,
> Tony T.
>
>
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrus> ions
>

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions



_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions