Re: Increase in Sun RPC Scans

From: Rick Robinson (goodwolfat_private)
Date: Thu Apr 19 2001 - 08:36:46 PDT

Next message: Joe Butin: "Re: Increase in Sun RPC Scans"

Previous message: Prashanth Ram: "Re: Increase in Sun RPC Scans"
In reply to: Jason Lewis: "Increase in Sun RPC Scans"
Next in thread: Muenther, Jan: "Re: Increase in Sun RPC Scans"
Next in thread: Joe Butin: "Re: Increase in Sun RPC Scans"
Reply: Muenther, Jan: "Re: Increase in Sun RPC Scans"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I have also seen a very large increase in port 111 scans over the past
couple of weeks. I don't run any of the rpc services so I am unable to
determine what type of scans these are. I assume it is one of the various
recent Linux worms.

Rick
----- Original Message -----
From: "Jason Lewis" <jlewisat_private>
To: <INCIDENTSat_private>
Sent: Wednesday, April 18, 2001 10:28 PM
Subject: Increase in Sun RPC Scans

> Anyone else seeing an increase in SunRPC (port 111) scans?  Several
networks
> I manage are getting scanned from lots of different hosts.
>
> The scans are random IP's on the same subnet, I guess to evade IDS?
>
> Jason Lewis
> http://www.rivalpath.com
> "All you can do is manage the risks. There is no security."
>

Next message: Joe Butin: "Re: Increase in Sun RPC Scans"
Previous message: Prashanth Ram: "Re: Increase in Sun RPC Scans"
In reply to: Jason Lewis: "Increase in Sun RPC Scans"
Next in thread: Muenther, Jan: "Re: Increase in Sun RPC Scans"
Next in thread: Joe Butin: "Re: Increase in Sun RPC Scans"
Reply: Muenther, Jan: "Re: Increase in Sun RPC Scans"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Apr 19 2001 - 09:54:41 PDT