Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 2 subscribers
  • Views 594 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Portscan notification

sxcarlson
I'm trying to make sense of a series of e-mail alerts I got from my ASL box last night, 26 of them with messages similar to this...

A T T E N T I O N
=================

Portscan detected:
------------------
   System Date: Oct 26 2002
   System Time: 03:14:47

     Source IP: 192.168.1.10
     Target IP: 67.84.203.164

If I'm interpreting this correctly, it would seem that a box on my network is doing the port scanning.  Am I correct?  Is there a reasonable explaination?  Is this box infected with a worm of some sort?


This thread was automatically locked due to age.
Parents
  • 0
    may be ... ;-)

    well, is it always the same destination-adress?
    look who has this adress.
    maybe someone tries dns-lookups or too many ftp-channels?
    that would not be so harmful ...
    But:
    maybe it's really some infection on this client?
    maybe some other client changes it's ip, running portscans, changes the ip back?

    take a virus-scanner, look for rootkits on unix-machines, ....

    good luck!
Reply
  • 0
    may be ... ;-)

    well, is it always the same destination-adress?
    look who has this adress.
    maybe someone tries dns-lookups or too many ftp-channels?
    that would not be so harmful ...
    But:
    maybe it's really some infection on this client?
    maybe some other client changes it's ip, running portscans, changes the ip back?

    take a virus-scanner, look for rootkits on unix-machines, ....

    good luck!
Children
No Data