The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
2answers
91 views

Linux/Bash: Test if my server is opened to the Internet programmatically/via CLI

RHEL 6 and Bash. It would be easy if I had a remote server to just run nmap from, or even curl/wget, but I only have access to servers on our side of the firewall. I know I can manually check ...
-2
votes
1answer
43 views

Hiding services from port scan

Upon running a port scan on my server: 22/tcp open ssh (protocol 2.0) 80/tcp open http nginx 1.4.6 (Ubuntu) 443/tcp open http nginx 1.4.6 (Ubuntu) 3000/tcp open ppp? 3001/tcp open ...
0
votes
1answer
27 views

Service pn-requester (2717) port information

I have not found big information on the internet about what does this service and for what is used. I apreciate if someone can explain to me a little. Thank you
1
vote
0answers
93 views

Port Scanning/Telnet login attempts [closed]

I have set iptables to block and log all inputs other than HTTP/HTTPS/SSH. The logs have many entries with DPT=23. Most entries are like: DATE-TIME * kernel: [*] IPTables-Dropped: IN=venet0 OUT= ...
0
votes
2answers
64 views

iptables settings open ports

ipables configuration Trying to allowing connection to a server from the outside world. Port scanners are reporting the ports are not open. Just after confirmation my iptables are correctly set. ...
0
votes
1answer
79 views

Server sending packets every 5 minutes to 3 IPs

Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling ...
3
votes
1answer
96 views

Scan SSH for offered authentication options

I'd like to scan our network (IPv4 and IPv6) for ssh and find the offered authentication options. Ultimately I'd like to end up with a parseable list[1] of hosts that contains the following info: ...
1
vote
1answer
185 views

Snort, Portscans and Scanned IP Range field

According to manual.snort.org, TCP Portscans goes from one computer to other one, but when you take a look to an tcp portscan alert in snort/snorby you can see this: In one hand: Source: ...
-5
votes
1answer
72 views

Is it possible to detect the original IP performing a port scanning to a public service through a VPN server? [closed]

I am performing a port scanning with NMAP from my laptop to some public services on Internet... I am using a VPN service, therefore my port scanning goes through VPN server and later hits the machines ...
1
vote
0answers
83 views

Why does scanlogd miss port scans?

I am running scanlogd to detect port scans. I have observed the following to generate a log message in /var/log/syslog. When I use zenmap (nmap gui) to port scan this system from another computer on ...
1
vote
1answer
2k views

What is msrpc needed for on a Windows 7 workstation

I just ran an nmap scan against our network, and many Windows 7 machines have several high ports listening with Microsoft Windows RPC. Example: Port Serv Process name 49152, msrpc [wininit.exe] ...
0
votes
1answer
404 views

How to detect my server is used as a port scanner? [duplicate]

My Web Server is running Ubuntu 12.04.2 LTS with all security updates installed. It is used as a Web Proxy server that handles incoming requests on HTTP/80 HTTPS/443 but also retrieves web content ...
1
vote
2answers
566 views

pfSense and Snort: unexpected portscan traffic on interface

I have a pfSense box acting as my public facing router and stateful firewall. There is 1 WAN interface and several LAN interfaces using private IPs behind NAT. I EXPECT to see portscans or all kinds ...
0
votes
1answer
99 views

Do an os scan with nmap only

Is it possible to do an OS detection scan with nmap without scanning a port? I really need only OS detection and try to reduce the amount of traffic as much as possible. By the way what is the most ...
1
vote
2answers
934 views

Port Scanning Temporary Block on Linux Centos

I am running a VPS server (Linux CentOS) to provide web hosting for my clients. Yesterday, one of my clients got blocked out by the LFD firewall on my server: I got a server admin email notification ...
0
votes
1answer
226 views

Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role

Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this: The message repeats every second and the port number is increased by one the range ...
0
votes
1answer
434 views

Frequent UDP_IN Blocked for Port Scanning

I run a blog self-hosted with Wordpress. I'm getting frequent email notifications from LFD regarding UDP_IN blocks. I usually get 10+ emails daily about it. The email looks like following: Time: ...
0
votes
2answers
277 views

nmap scan only state of port

Is it possible with nmap to check only the state of a port whether- open, closed or filtered and NOT the services behind it? The aim is to speed up scan results. Since UDP scan is also involved it is ...
0
votes
0answers
282 views

Cannot enable shunning of IP scan attackers - error message on asa 5520

I've got the scanning threat detection turned on, in my Cisco ASA 5520, but someone turned off the option for "shun hosts detected by scanning threat". Now, when I try to enable it through the ASDM ...
2
votes
2answers
711 views

Weird Port scanning results using nmap

I was scanning one of my friends servers using nmap and got these port details. PORT STATE SERVICE 22/tcp open ssh 42/tcp filtered nameserver 80/tcp open http 111/tcp open ...
1
vote
2answers
300 views

How to prevent port scanning by VPN users on a CentOS VPN gateway

I'm using CentOS as a VPN gateway. Users connected to my server have access to the internet. The problem is that some of the users' computers are infected with some kind of worm, and as soon as they ...
0
votes
1answer
809 views

Symantec Endpoint Protection “portscan attack” false alarms?

On two Windows 7 machines in my LAN I have Symantec Endpoint Protection 12.1 installed. Things work fine, but several time per day I get to see the following warning: I had a thorough look at the ...
0
votes
1answer
565 views

identity and rectify port scanning activities on CentOS [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux (CentOS 5.x) machine seem to have been attacked. Port scanning activities were traced to it. However, the ports (to be) ...
42
votes
11answers
5k views

Does changing default port number actually increase security?

I have seen advice saying you should use different port numbers for private applications (e.g. intranet, private database, anything that no outsider will use). I am not entirely convinced that can ...
1
vote
1answer
136 views

Detecting a host doing a port sweep across multiple interfaces/networks

I'm trying to set up a honey-pot like machine that would detect port sweeps from multiple networks with multiple interfaces. As an illustration, if I could set up a box with eth1, eth2 and eth3. ...
1
vote
1answer
170 views

Nmap reporting incorrect results from an idle scan

I have a VPS that I was scanning to make sure everything is in check. A regular SYN scan reports that ports 25 and 80 are open (which they should be). When I run an idle scan however, I get back that ...
0
votes
1answer
753 views

All-day Port scanning “victim” - How worried should I be? (CentOS)

In addition to my day job as a technical support specialist, I operate a shared web hosting environment and run a number of servers for this purpose. I run a LAMP environment. Beginning at 4am ...
3
votes
3answers
455 views

IPv6 replacement for scanning IP range

Under IPv4, I often use nmap to scan my entire IP range to identify newly-connected devices and update my documentation, track down and shut off things that don't belong on the network, etc. I even ...
1
vote
5answers
3k views

Can't get nmap to work under Windows 7 64 bit

I'm trying to install and run the nmap tool to test my server, but it keeps saying Note: Host seems down. If it is really up, but blocking our ping probes, try -P0 and showing all the server ports ...
0
votes
2answers
320 views

how do I scan all computers in my network with nmap?

I am trying to use nmap to scan the computers on my network for conficker. I am using Windows. What do I put in the target for all computer on a given subnet? It is running: nmap -T4 -A -v I put ...
1
vote
3answers
2k views

how to protect from port scanning a windows server 2008

I am search to find a program, or a way to block ips that make port scan on the server. The goal is to hide some ports like remote desktop on a different port. So some are search the port with port ...
2
votes
1answer
238 views

Are random packets normal?

About a month ago on one of my servers I started receiving random packets from IPs all over the world. So I did the smart thing and stopped putting off installing an IDS. This IDS is a ClearOS Gateway ...
2
votes
6answers
2k views

Detect computer which does port scanning

I have about 15 computers on a local network behind simple TP-LINK TL-WR340G router. Everything works fine and the router does its job. Recently we were informed that port scanning is being performed ...
7
votes
9answers
748 views

Network vulnerability and port scanning services

I'm setting up a periodic port scan and vulnerability scan for a medium-sized network implementing a customer-facing web application. The hosts run CentOS 5.4. I've used tools like Nmap and OpenVAS, ...
0
votes
5answers
527 views

Angry IP Scanner - no response to test

When performing a telnet command to a remote FTP port from the Windows command line, it connects as expected. I have about 20 external hosts to connect to. I've imported the list for the Angry IP ...