Re: Is there any legit reason for TCP scans?

From: Grace Chung (gchung4848_at_yahoo.com)
Date: 05/01/04

  • Next message: Bit Twister: "Re: HACKERS SECRET WEAPONS:" 
    Date: 30 Apr 2004 19:33:02 -0700

    Well according to http://smb.sygate.com/support/documents/spf/SPF_WebHelp/performing_a_tcp_scan.htm

    they have a software that does the following:

    Performing a TCP Scan

    The TCP scan examines the 1,024 ports that are mainly reserved for TCP
    services, such as instant messaging services, to see if these ports
    are open to communication. Open ports can indicate a dangerous
    security hole that can be exploited by malicious hackers.

    It scans ports on your computer that are connected to devices such as
    routers and proxies for users connecting to the Web site through such
    a device. The scan takes about 20 minutes to complete and is logged by
    the Personal Firewall as a scan event in the Security log

    But normal circumstances TCP is just to see what ports are open and
    working. Type netstat -a in the command line and u will see active
    connections/ports also. But usually like u said before tcp scans are
    run to see any vulnerable spots or such.

    "William Morris" <seamNOlyneSPAM@hotmail.com> wrote in message news:<sVykc.3390$oP7.1043@newssvr24.news.prodigy.com>...
    > Well, there you see, is the rub. We own both servers, and neither our
    > anti-virus nor Stinger reports the presence of anything malicious. Stinger
    > is the latest version, and the anti-virus db is up to date.
    >
    > Stumped, looking for direction.
    >
    > "Robert Delahunt" <neosad1st@charter.net> wrote in message
    > news:1095a20i6sct9c0@corp.supernews.com...
    > > William Morris wrote:
    > >
    > > > Tried this question in a couple of other groups, but got no response.
    > > >
    > > > Our production server's firewall is reporting TCP Port Scan from our
    > > > development server three or four times an hour, every day. AVG av and
    > > > Stinger.exe don't show anything in particular. Is there any legitimate
    > > > reason for the activity I'm seeing?
    > > >
    > > >
    > > > --
    > > > William Morris
    > > > Product Development, Seritas LLC
    > > > Kansas City, Missouri
    > >
    > > My opinion, no. There should be none, in theory, unless it's worms maybe.
    > > Then again, I don't think it's a criminal act, either. But if you don't
    > > appreciate it, contact their ISP and complain.
    > >
    > > --
    > > I'm all for computer dating, but I wouldn't want one to marry my sister.
    > >

  • Next message: Bit Twister: "Re: HACKERS SECRET WEAPONS:"

    Relevant Pages

    • RE: IM Programs
      ... want to block these ports. ... you don't need an explicit deny for the other ports. ... Access-list 101 deny any tcp any any eq 5000 ... >Now, when applying these to your firewall, make sure the number ...
      (Security-Basics)
    • Re: What should I block out with my new firewall software?
      ... >> block out that I don't use or need, like UDP or TCP. ... >> activity or attempts from outside hackers to penetrate these ports. ... never stop svchost from comunnicating on the Internet. ... > Web updates, as far as I know, are downloaded the same way that ...
      (comp.security.firewalls)
    • Re: Fingerprinting Windows O/S based on ports open?
      ... finger printing by open default ports is not always ... OS fingerprinting is not as plain and claer cut as it was perhaps a few ... settings in tcp packets. ... >> Looking for a better way to manage your IP security? ...
      (Pen-Test)
    • Re: NFS inconsistent behaviour
      ... of tcp connections in TIME_WAIT state. ... Why there are so many connections in waiting state? ... and remote port so the ports stay in use for a few minutes. ... I ran out of privileged ports due to treemounting on /net from about 50 ...
      (Linux-Kernel)
    • Re: Netmeeting Port question
      ... 1503 tcp chat,whiteboard,shares,filetransfer ... I do not think you get the dynamic ports thru the router. ... >connection when establishing a remote desktop sharing ...
      (Security-Basics)
    Loading