Re: large scale distributed scan of port tcp 445

From: Muhammad Faisal Rauf Danka (mfrdat_private)
Date: Thu Aug 08 2002 - 16:53:41 PDT

  • Next message: Russell Fulton: "Re: [unisog] Re: large scale distributed scan of port tcp 445"

    Which firewall logs these are? ,Because i'm unable to find the bits
    set, whether it was a TCP Scan of halfopen SYN Scan?
    Since mostly worms would TCP Scan from infected boxes, so if it's
    a SYN Scan, then probably it's an intentional Scan. 
    just wondering..
    Muhammad Faisal Rauf Danka
    Chief Technology Officer
    Gem Internet Services (Pvt) Ltd.
    --- Russell Fulton <r.fultonat_private> wrote:
    >Greeting All,
    >	    Again my apologies to those of you who receive two copies of this
    >note I am posting it to both unsog and incidents since a fair number of
    >educational sites are involved. This posting may also be related to an
    >ongoing discussion on the unsog list of compromised W2K boxes.
    >At around 0545 on the 8th Aug (UTC) we got hit by a distributed scan
    >from 100 machines scattered around the world.  Most of the addresses are
    >owned by large IPS and domain names indicate that they are cable or xdsl
    >customers. A significant minority of the addresses belonged to
    >educational institions (one Taiwanese institution was very well
    >represented :( ).  I have notified all the edu sites that I can identify
    >and will work through the ISPs later today.
    >For the record it took them 6 minutes to scan our entire /16 address
    >here is a cut and paste from my index of scans, the time at the start is
    >just to 1 hour resolution.
    >2002.[] - Network_scan[tcp-445] - new
    >2002.[] - Network_scan[tcp-445] - new
    >2002. [] - Network_scan[tcp-445] - new
    >2002.[] - Network_scan[tcp-445] - new
    Promote your group and strengthen ties to your members with emailat_private by
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see:

    This archive was generated by hypermail 2b30 : Fri Aug 09 2002 - 08:30:30 PDT