On Thu, Jul 24, 2003 at 03:14:48PM +0100, Colin Fraser wrote: > Thanks Neil, and Paul. > > Much as I expected, 'tho it's interesting the number of scans I'm getting from > Eastern Europe as well (I might follow up the one from Lerwick, just out of > curiousity). > > Nice to see the firewall seems to be working! > > By the way, does anyone know any analysis tools I might use to analyse > /var/log/messages to see what's going on? It's a pain trying to check the > services and protocol files each time to work it out. >
All the 'scans' to port 135 or 139 are NetBIOS - whether they're misconfigured Windows boxes automatically scanning for shares or spammers trying to use the winpopup messaging system isn't clear, but I'm guessing that there's an awful lot of random NetBIOS traffic out there, since Windows seems to automatically advertise its presence to the internet every few minutes. -- Bruce Cran
pgp00000.pgp
Description: PGP signature
