This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS: Many, many mails

Hello,

just a question. The last days we recognize many mails
[1:469:0] D ICMP PING NMAP [Classification: Attempted Information Leak] [Priority: 2]: {PROTO001} 212.152.39.1xx -> 212.114.235.xx

Sometimes every 2 minutes! What´s that? "Sasser and frinds" which scan IP´s ?

Who can give an advice?

Alex

This thread was automatically locked due to age.

Parents

0 bagira over 21 years ago

Hi Alex,
do you find more information in your IPS-Log?Somebody pings your IP-Address with nmap. Have a look in the WebAdmin which pattern matched and click on the link for more informations.
/bagira
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to bagira

Hello bagira,

no more Info from logs ! I cannot imagine that the number of pings increased so much. Especially since the time Sasser came to germany.... Cause of that I think these pings come from infected pc´s .

Who can help?

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 synopex over 21 years ago in reply to alasc

have a look in the ips counter (ips -> rules -> Hits).
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to synopex

Yes[:)]

Many many hits.... But where does it come from?

Greets Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 bagira over 21 years ago in reply to alasc

Which rule(s) contain the hits?
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to bagira

This one

[1:469:0] D ICMP PING NMAP [Classification: Attempted Information Leak] [Priority: 2]: {PROTO001

I´m at work and cannot look at the ASL.

Greets Alex
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 alasc over 21 years ago in reply to bagira

This one

[1:469:0] D ICMP PING NMAP [Classification: Attempted Information Leak] [Priority: 2]: {PROTO001

I´m at work and cannot look at the ASL.

Greets Alex
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 synopex over 21 years ago in reply to alasc

some kids has played with nmap an scan networks; have a look in your logs, are the scans from the same ip offen?
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to synopex

Ok that´s an ability.
I wasn t sure if it isn´t Sasser cause theses logs came exact same time Sasser came in front of our network.

Thanks to all

Alex
Cancel
Vote Up 0 Vote Down

Cancel