Re: Port 119 Scans

From: denis (denisat_private)
Date: Tue Jul 31 2001 - 10:16:41 PDT

  • Next message: Harri Nyman: "Re: TCP port 6346"

    Back when I had @home I also saw this type of prob. I just dropped the
    route back to the scanning system. This makes it look like your system is
    not even online to the scanning system.
    
    -d
    
    On Tue, 31 Jul 2001, Gary Maltzen wrote:
    
    > FWIW, I'm on @Home cable and about once every five hours I get probed to see if I'm running an NNTP server in violation of TOS.
    > 
    > Checking a multi-homed server I manage, I see lots of RPC, DNS, SQUID, TELNET, FTP and SMTP scans but *no* NNTP scans in the last three weeks.
    > 
    > -----Original Message----- 
    > Hi,
    > 
    > I'm seeing a lot of port 199 scans lately (very many the last week) .. Is there some sort of news server exploit out? Or am I the only one seeing this?
    > 
    > I'm on ADSL with dynamic IP so I don't think they'd be targetting me personally.. I don't run a newsserver...
    > 
    > Thanks,
    > Tom
    > 
    > 
    > ----------------------------------------------------------------------------
    > This list is provided by the SecurityFocus ARIS analyzer service.
    > For more information on this free incident handling, management 
    > and tracking system please see: http://aris.securityfocus.com
    > 
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Jul 31 2001 - 10:59:59 PDT