Re: Port scan attack

Roland Hughes wrote:
> Well since I have not seen you get a reply this is the best I can 
> offer. I do not use a router, on a very slow dial-up, and am running 
> 2010. I get port scanned allot(I know on dial-up? ;>}) and what I do 
> is right click the network icon in the lower right. I then select the 
> interactive firewall, I then select the offending IP in the window and 
> click the "blacklist" button. If there are more than one, quite often, 
> I select each intern and blacklist them.
> Good luck;
>
> On Mon, Feb 1, 2010 at 11:02 PM, Len Lawrence <lcl-s9phx+4gxdMG2Il/[email protected] 
> <mailto:lcl-s9phx+4gxdMG2Il/[email protected]>> wrote:
>
>     Mandriva 2008.1, cable modem, 4 port Belkin wired router.
>
>     In the past couple of days my internet connection has slowed down,
>     possibly by a factor of ten, and yesterday and this morning the
>     system has been subject to a port scanning attack.  The system
>     displayed a message indicating that it was mounted by my router
>     and showed a button "Process attack".  That disappeared before I
>     could react, replaced by a flashing warning triangle in the panel
>     so I wondered if there was any way to reactivate the Process
>     Attack option.  Does anybody know what it does?  Reverse DNS
>     lookup maybe and an opportunity to blacklist the source somehow?
>
>     The attack has stopped but it would be handy to know what to do if
>     it were repeated.
>
>     Len
>
>
>
> -- 
> Roly
> rolanddothughesatgmaildotcom
>
> I read somewhere that if you manage your money perfectly, you would 
> never run out, but the check that you wrote for your funeral should 
> bounce. ;>)
Thanks for the reply.  At one point I did go into the interactive 
firewall where two numbers were registered against two addresses, both 
the address of the router.  The numbers might have been PIDs.  So it 
looked like the attacker reached the router and mounted the attack from 
there.  I had hoped that the Process Attack option would have a way to 
identify the attacker's address(es).  There has been no more trouble 
today and network speed seems to be back to normal.

Sorry to hear that your connection is so limited.  The last thing you 
would want is a port scan attack.

Len


____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________