Re: scans

From: Alessandro Selli (spammami_at_libero.it)
Date: 06/18/03


Date: 18 Jun 2003 18:21:17 GMT

Nel fausto dė di Wed, 18 Jun 2003 13:30:10 GMT, il prode _g bell_
presente alla corte di _comp.os.linux.security_
cosė ebbe l'ardire di pronunziarsi:
| Good Morning
|
| I'm receiving scans from a certain ip range almost daily, here are
| relevant logs
|
| Jun 16 15:58:33 cpe0004758dbf50-cm024480006068 kernel: IN=eth0 OUT=
| MAC=00:04:75:8d:bf:50:00:00:77:94:69:dc:08:00 SRC=38.117.132.102
| DST=65.50.51.104 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=54115 DF PROTO=TCP
| SPT=80 DPT=1206 WINDOW=0 RES=0x00 RST URGP=0

  Where you (or someone else from your network) navigating when this happened?
My guess is that the connection started from your side and that some load
balancer in the contacted server (that could be some advertisement web server
serving some content in the page that was beeing loaded) tryed to open another
connection into your machine that would go throught some other interface it
found less busy than the one that received your connection. this would
explain the source port beeing a low-numbered one (80) and the destination
port beeing a high one (1206).

  Sandro

-- 
"In a world without walls and fences
you would not need windows and gates."
(Confucius)


Relevant Pages

  • Re: how to handle multiple-message-in-same data-buffer (async programming)
    ... if it's _not_ on separate ... then the recipient (whether server or client) is by definition ... If you're talking about receiving two messages that were sent on the same ... connection by the same sender, then the only "same time" you could be ...
    (microsoft.public.dotnet.languages.csharp)
  • The remote peer is no longer responding
    ... " Secure VPN connection terminated locally by the Client. ... RECEIVING <<< ISAKMP OAK AG, VID, VID, KE, ID, ... Crypto Active IKE SA, ...
    (comp.dcom.sys.cisco)
  • Re: how to handle multiple-message-in-same data-buffer (async programming)
    ... then the recipient (whether server or client) is by definition _not_ receiving two messages exactly at the same time. ... If you're talking about receiving two messages that were sent on the same connection by the same sender, then the only "same time" you could be talking about is that they may be combined into a single chunk of data to be received by your server. ... This means that before you start processing a chunk of received data, you need to check to make sure you've completed receives on all of the buffers that were posted before the one you're operating on currently. ...
    (microsoft.public.dotnet.languages.csharp)
  • (still) problems with email/ssl and t-online.de/telekom.de
    ... problem wich is a secure connection for my emails. ... I thought I had solved it but it was probably only for receiving ... I changed the type from SimplePOP3Retriever to SimplePOP3SSLRetriever ...
    (freebsd-questions)
  • Re: Return route not added on demand dial router
    ... on the server on the receiving end of the calls. ... using route print yields a different story. ... We have checked the user and interface names. ... In fact the gateway doesn't exist until you make the connection. ...
    (microsoft.public.win2000.ras_routing)