> You mean you are scanned thru the ports in the 2100 range and/or the > 2400 range? > Huh. At first, I thought you meant ports 21-24, which would make > obvious sense > but I am not clear on the intent for checking out the 2100s or 2400s. 2100's and 2400's ranges. > I have been running different types of scans against 63.98.105.3 and can > neither > make an OS determination nor find any port that is not filtered. Not > even port > 22 is open, so whoever it is doesn't use ssh. The other filtered ports > indicate > that this person also isn't running any kind of ftp server (or permit > any kind of ftp access to him/herself or anyone else for that matter). > No telnet > access either. Don't know who's IP that is, but it ain't mine. Unfortunately, I do have to chagne something in my firewall settings since I just realised there is a slight hole, but other then that gaping drive a truck through that huge hole hole, it's secure :) > Often, I have found that when I get a "too many fingerprints to make an > accurate > OS guess" message (nmap), it turns out to be because it is receiving > mixed fingerprints, > possibly due to the fact that SOME port on the 63.98.105.3 box is open > to the world > while everything else is filtered through a different firewall box (not > a sure thing > but this is my experience thus far). Will remember that. Might come in handy. > On my own system at home, if I scan it from a remote location I get the > "too many > fingerprints" message, though I am running linux. The reason is that I > have a cisco > box between my box and the net and I have setup a port forward in the > cisco box. > Nmap sees responses from both the cisco AND my linux box, via port 22, > so it screws > up the ID. If I dump the port forward, nmap identifies the box as a > Cisco. Will definitely remember that. That'll definitely come in handy. > I am still trying, merely as a learning exercise at this point, to get > ANY useful > information from 63.98.105. Cool cool. I should post the IPs of the three guys that keep scanning me as soon as I get home. > > Anthony Russello wrote: > > > > I'm not getting attacked from this alter.net IP, but I am being > > constantly scanned on consecutive ports usually ranging in the 21xx or > > 24xx range. My firewall (a windows based firewall/proxy ap on an > > NT4 server) blocks both of these ranges, so all I see are requests on port > > 21xx and each is denied. > > > > There are 3 separate IP addresses doing this, but they are one after the > > other scanning ports in consecutive order. > > > > Anyone ever seen anything like this? > > > > > You are not alone, I've also been attacked by someone from this > > > alter.net site. Do a google search for alter.net and you should find > > > more information. > > > > > > From my searches, alter.net is a small? ISP in BC canada... > > > > > > > > > On Wed, 29 Nov 2000 22:17:42 -0800, you wrote: > > > > > > >There is an ip number that started showing up in my postfix logs > > > >as trying to access my smtp server (and access was apparently > > > >denied each time). I assumed that someone was trying to use > > > >my machine as a relay. To make sure that they can't get through, > [...] > > There's plenty of semicolons to go around
Keep in touch with http://mandrakeforum.com: Subscribe the "[EMAIL PROTECTED]" mailing list.
Keep in touch with http://mandrakeforum.com: Subscribe the "[EMAIL PROTECTED]" mailing list.
