Firewall Logs

From: Luca (nasdaq44_at_hotmail.com)
Date: 01/03/05


Date: 3 Jan 2005 21:04:41 +0100

Hi!,

in our company we have a Windows NT 4.0 server with SP6a, SQL Server 7.0 SP4
and Exchange Server.
We use this server to host our web site and mails

After Many years without problems, in the last 2 months i have noticed a
problem: sometimes, ASP pages returned this error: Server object error 'ASP
0177 : 800706ba' RPC Server Unavailable

Checking che Task Manager i have noticed that RPC Service was stopped (and
never wanted to restart without restarting the whole server)

The fact i installed the updates make me to exclude Sasser and C...

Than (today) we installed a Hardware Firewall

I have seen many interesting things (many pings, ftp access attempt...) and,
above all, i have seen that OUR SERVER was scanning many ports over the
internet

In particular the source was our server at port 1433 or 80 or 110

The fact i saw port 1433 makes me think about the Slammer Worm but we have
installed the updates.... and i also used the removal tool that did not find
anything...

In the end, the port scanning coming from the 80 and 110 port makes me
insane!!!

i do not know what to think now

Can someone act in a way that my server seems to make this port scanning
while, in fact, it is not?

Have you got any ideas?

Many Thanks

Paul



Relevant Pages

  • RE: Some technical errors
    ... If the SMTP server is not running on port 25 TCP it is not a public ... Manager - Computer Assurance Services BDO Chartered Accountants & ...
    (Security-Basics)
  • Re: Managing "capabilities" for security
    ... default tickets are held by the kernel and can be chosen by the parent ... The default ticket for any particular call is assumed unless the ... than to check that the server address on the ticket is good. ... the kernel had to invoke the RPC if the service port IN YOUR ...
    (comp.arch.embedded)
  • Re: SRV RRs support in Internet Explorer?
    ... The port number could be implicit (i.e. ... At any point in time, a server could fail ... can't effectively LB or backup because NSs cache the records for the TTL ... I still don't see how SRV records would help backup or LB. ...
    (microsoft.public.win2000.dns)
  • Re: Still cant connect to RWW or OWA remotely
    ... I get 'cannot find server or dns error' on both ... TCP [port number]> to open the ports. ... As for error messages when I fail to access RWW with the laptop, ... network, no connection seems possible. ...
    (microsoft.public.windows.server.sbs)
  • Re: cannot send mail from Windows mail
    ... When a username/password combination doesn't work in Windows Mail, ... I mean I dont use it but as outgoing address for my ISP account. ... youir username and password are correct for your mail server". ... Ask your home ISP if they support SMTP on a port other than 25. ...
    (microsoft.public.windows.vista.mail)