Re: scans

From: Alessandro Selli (spammami_at_libero.it)
Date: 06/18/03 

Date: 18 Jun 2003 18:21:17 GMT

Nel fausto dė di Wed, 18 Jun 2003 13:30:10 GMT, il prode _g bell_
presente alla corte di _comp.os.linux.security_
cosė ebbe l'ardire di pronunziarsi:
| Good Morning
|
| I'm receiving scans from a certain ip range almost daily, here are
| relevant logs
|
| Jun 16 15:58:33 cpe0004758dbf50-cm024480006068 kernel: IN=eth0 OUT=
| MAC=00:04:75:8d:bf:50:00:00:77:94:69:dc:08:00 SRC=38.117.132.102
| DST=65.50.51.104 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=54115 DF PROTO=TCP
| SPT=80 DPT=1206 WINDOW=0 RES=0x00 RST URGP=0

  Where you (or someone else from your network) navigating when this happened?
My guess is that the connection started from your side and that some load
balancer in the contacted server (that could be some advertisement web server
serving some content in the page that was beeing loaded) tryed to open another
connection into your machine that would go throught some other interface it
found less busy than the one that received your connection. this would
explain the source port beeing a low-numbered one (80) and the destination
port beeing a high one (1206).

  Sandro 

-- 
"In a world without walls and fences
you would not need windows and gates."
(Confucius)

Relevant Pages

  • Re: how to handle multiple-message-in-same data-buffer (async programming)
    ... if it's _not_ on separate ... then the recipient (whether server or client) is by definition ... If you're talking about receiving two messages that were sent on the same ... connection by the same sender, then the only "same time" you could be ...
    (microsoft.public.dotnet.languages.csharp)
  • The remote peer is no longer responding
    ... " Secure VPN connection terminated locally by the Client. ... RECEIVING <<< ISAKMP OAK AG, VID, VID, KE, ID, ... Crypto Active IKE SA, ...
    (comp.dcom.sys.cisco)
  • Re: how to handle multiple-message-in-same data-buffer (async programming)
    ... then the recipient (whether server or client) is by definition _not_ receiving two messages exactly at the same time. ... If you're talking about receiving two messages that were sent on the same connection by the same sender, then the only "same time" you could be talking about is that they may be combined into a single chunk of data to be received by your server. ... This means that before you start processing a chunk of received data, you need to check to make sure you've completed receives on all of the buffers that were posted before the one you're operating on currently. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Return route not added on demand dial router
    ... on the server on the receiving end of the calls. ... using route print yields a different story. ... We have checked the user and interface names. ... In fact the gateway doesn't exist until you make the connection. ...
    (microsoft.public.win2000.ras_routing)
  • Re: Strange rule
    ... >I'm receiving this kind of message in the netfilter logs: ... When a TCP connection is set up, the originating computer sends a packet ... The peer makes note of this number, ... flag set, and proposes it's own 32 bit number that is will start counting ...
    (comp.os.linux.security)