Re: Port scan attack

Did you put in a "REAL GOOD" admin password? A lot of people know the
defaults and can own your router. I used a linksys years ago and put in a 30
character password, even then I was nervous.

On Tue, Feb 2, 2010 at 3:39 PM, Len Lawrence <lcl-s9phx+4gxdMG2Il/[email protected]>wrote:

> Roland Hughes wrote:
>
>> Well since I have not seen you get a reply this is the best I can offer. I
>> do not use a router, on a very slow dial-up, and am running 2010. I get port
>> scanned allot(I know on dial-up? ;>}) and what I do is right click the
>> network icon in the lower right. I then select the interactive firewall, I
>> then select the offending IP in the window and click the "blacklist" button.
>> If there are more than one, quite often, I select each intern and blacklist
>> them.
>> Good luck;
>>
>> On Mon, Feb 1, 2010 at 11:02 PM, Len Lawrence <lcl-s9phx+4gxdMG2Il/[email protected]<mailto:
>> lcl-s9phx+4gxdMG2Il/[email protected]>> wrote:
>>
>>    Mandriva 2008.1, cable modem, 4 port Belkin wired router.
>>
>>    In the past couple of days my internet connection has slowed down,
>>    possibly by a factor of ten, and yesterday and this morning the
>>    system has been subject to a port scanning attack.  The system
>>    displayed a message indicating that it was mounted by my router
>>    and showed a button "Process attack".  That disappeared before I
>>    could react, replaced by a flashing warning triangle in the panel
>>    so I wondered if there was any way to reactivate the Process
>>    Attack option.  Does anybody know what it does?  Reverse DNS
>>    lookup maybe and an opportunity to blacklist the source somehow?
>>
>>    The attack has stopped but it would be handy to know what to do if
>>    it were repeated.
>>
>>    Len
>>
>>
>>
>> --
>> Roly
>> rolanddothughesatgmaildotcom
>>
>> I read somewhere that if you manage your money perfectly, you would never
>> run out, but the check that you wrote for your funeral should bounce. ;>)
>>
> Thanks for the reply.  At one point I did go into the interactive firewall
> where two numbers were registered against two addresses, both the address of
> the router.  The numbers might have been PIDs.  So it looked like the
> attacker reached the router and mounted the attack from there.  I had hoped
> that the Process Attack option would have a way to identify the attacker's
> address(es).  There has been no more trouble today and network speed seems
> to be back to normal.
>
> Sorry to hear that your connection is so limited.  The last thing you would
> want is a port scan attack.
>
>
> Len
>
>
> ____________________________________________________
> Want to buy your Pack or Services from Mandriva? Go to
> http://store.mandriva.com
> Join the Club : http://www.mandrivaclub.com
> ____________________________________________________
>



-- 
Roly
rolanddothughesatgmaildotcom

I read somewhere that if you manage your money perfectly, you would never
run out, but the check that you wrote for your funeral should bounce. ;>)
____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________