RE: Unusual port scan?

From: Bojan Zdrnja (Bojan.Zdrnja_at_LSS.hr)
Date: 12/29/03

  • Next message: Jerry Shenk: "RE: Unusual port scan?" 
    To: "'J Bailes'" <jonas2@knology.net>, <incidents@securityfocus.com>
Date: Mon, 29 Dec 2003 17:51:16 +1300

     

    > -----Original Message-----
    > From: J Bailes [mailto:jonas2@knology.net]
    > Sent: Monday, 29 December 2003 11:59 a.m.
    > To: incidents@securityfocus.com
    > Subject: Unusual port scan?
    >
    >
    >
    > My router logs on my personal/home machine just started
    > receiving with these scans:
    >
    > 12/28/2003 13:05:44.133 - 81.52.250.105 : 80 >>> xx.xxx.xxx.xxx : 1800
    > 12/28/2003 13:04:50.236 - 81.52.250.105 : 80 >>> xx.xxx.xxx.xxx : 1802

    Do you have TCP flags in logs as well that you could post?

    This looks to me like reply from normal Web service - maybe someone sent
    spoofed SYN packets to Akamai boxes with your IP address set as the source
    address.

    There is no reason (AFAIK) for Akamai to scan you.

    Cheers,

    Bojan

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: Jerry Shenk: "RE: Unusual port scan?"