This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to determine source of internal port scans

Our main Windows 2003 server has always generated a occasional port scans against the firewall. That's fine - I don't want to exclude it in case some kind of malware infects the server.

The problem is we started getting lots of port scan warnings with this server being the source. So something has started running on that server that is port scanning the firewall. But I don't know how to determine what is doing it. I don't see anything out of the ordinary running on the server, and we haven't made any changes or installed anything new on the server.

So the question is, how do we track down what is performing these port scans?

Thanks.

This thread was automatically locked due to age.

Parents

0 BrucekConvergent over 17 years ago

Start with making a note of the source port of the scan... then use any of the process info tools out there (netstat -ao will give you a pid on a specific port) on the Windows server to see what process is causing it... that should give you enough info to figure it out.
Cancel
Vote Up 0 Vote Down

Cancel
0 eganders_01 over 17 years ago in reply to BrucekConvergent

Or netstat -b will give you the name of the running app that opened the port.
Cancel
Vote Up 0 Vote Down

Cancel
0 jmadren over 17 years ago in reply to eganders_01

Thanks guys.

I've been using netstat to try to capture what could be performing the port scan against the firewall, when it's happening. So far, I haven't found any correlation. Is it possible that something else on our network is spoofing the ip address of this server? If so, how would you find it?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 jmadren over 17 years ago in reply to eganders_01

Thanks guys.

I've been using netstat to try to capture what could be performing the port scan against the firewall, when it's happening. So far, I haven't found any correlation. Is it possible that something else on our network is spoofing the ip address of this server? If so, how would you find it?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 bitonw over 17 years ago in reply to jmadren

have you any packet sniffers in your network like cisco nam or a pc with wireshark so you can make a capture of traffic? then you can get a better picture of whats going on in your network.

good luck
Cancel
Vote Up 0 Vote Down

Cancel
0 jmadren over 17 years ago in reply to bitonw

Thanks. I'll try setting up Wireshark. Do you have any tips for using it for this particular problem?
Cancel
Vote Up 0 Vote Down

Cancel
0 Wikked over 17 years ago in reply to jmadren

Thanks. I'll try setting up Wireshark. Do you have any tips for using it for this particular problem?

... the wireshark help forum. [:)]
http://www.wireshark.org/
Cancel
Vote Up 0 Vote Down

Cancel