The port-scanning tag has no wiki summary.
1
vote
2answers
88 views
pfSense and Snort: unexpected portscan traffic on interface
I have a pfSense box acting as my public facing router and stateful firewall.
There is 1 WAN interface and several LAN interfaces using private IPs behind NAT.
I EXPECT to see portscans or all kinds ...
0
votes
1answer
57 views
Do an os scan with nmap only
Is it possible to do an OS detection scan with nmap without scanning a port? I really need only OS detection and try to reduce the amount of traffic as much as possible.
By the way what is the most ...
1
vote
2answers
194 views
Port Scanning Temporary Block on Linux Centos
I am running a VPS server (Linux CentOS) to provide web hosting for my clients.
Yesterday, one of my clients got blocked out by the LFD firewall on my server:
I got a server admin email notification ...
0
votes
1answer
75 views
Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role
Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this:
The message repeats every second and the port number is increased by one the range ...
0
votes
0answers
27 views
Find mobile device on network [closed]
I'm trying to write a small program that will poll the network for certian ip addresses or mac addresses (though mac doesnt seem to show up past my WAP)
My networking isn't very strong but many ...
0
votes
1answer
181 views
Frequent UDP_IN Blocked for Port Scanning
I run a blog self-hosted with Wordpress. I'm getting frequent email notifications from LFD regarding UDP_IN blocks. I usually get 10+ emails daily about it.
The email looks like following:
Time:
...
0
votes
0answers
61 views
Difference between RST/ACK and RST responses in a Null scan
From what I have researched so far on NULL scans, there are 2 conflicting answers at the end of the NULL scan.
In a NULL scan, some sources state that if RST/ACK response is received from the server, ...
0
votes
2answers
95 views
nmap scan only state of port
Is it possible with nmap to check only the state of a port whether- open, closed or filtered and NOT the services behind it?
The aim is to speed up scan results. Since UDP scan is also involved it is ...
0
votes
0answers
137 views
Cannot enable shunning of IP scan attackers - error message on asa 5520
I've got the scanning threat detection turned on, in my Cisco ASA 5520, but someone turned off the option for "shun hosts detected by scanning threat".
Now, when I try to enable it through the ASDM ...
2
votes
2answers
288 views
Weird Port scanning results using nmap
I was scanning one of my friends servers using nmap and got these port details.
PORT STATE SERVICE
22/tcp open ssh
42/tcp filtered nameserver
80/tcp open http
111/tcp open ...
1
vote
2answers
168 views
How to prevent port scanning by VPN users on a CentOS VPN gateway
I'm using CentOS as a VPN gateway.
Users connected to my server have access to the internet. The problem is that some of the users' computers are infected with some kind of worm, and as soon as they ...
0
votes
1answer
374 views
Symantec Endpoint Protection “portscan attack” false alarms?
On two Windows 7 machines in my LAN I have Symantec Endpoint Protection 12.1 installed. Things work fine, but several time per day I get to see the following warning:
I had a thorough look at the ...
0
votes
0answers
236 views
psad block IP with shorewall
I'll try to configure psad with shorewall.
My shorewall works
In psad.conf I had :
FW_MSG_SEARCH Shorewall:net2fw:DROP:;
And I receive alertes, but the IP wich scan is not blocked.
How ...
0
votes
1answer
231 views
identity and rectify port scanning activities on CentOS [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
My Linux (CentOS 5.x) machine seem to have been attacked. Port scanning activities were traced to it. However, the ports (to be) ...
37
votes
11answers
3k views
Does changing default port number actually increase security?
I have seen advice saying you should use different port numbers for private applications (e.g. intranet, private database, anything that no outsider will use).
I am not entirely convinced that can ...
1
vote
1answer
104 views
Detecting a host doing a port sweep across multiple interfaces/networks
I'm trying to set up a honey-pot like machine that would detect port sweeps from multiple networks with multiple interfaces.
As an illustration, if I could set up a box with eth1, eth2 and eth3.
...
1
vote
1answer
127 views
Nmap reporting incorrect results from an idle scan
I have a VPS that I was scanning to make sure everything is in check. A regular SYN scan reports that ports 25 and 80 are open (which they should be). When I run an idle scan however, I get back that ...
0
votes
1answer
632 views
All-day Port scanning “victim” - How worried should I be? (CentOS)
In addition to my day job as a technical support specialist, I operate a shared web hosting environment and run a number of servers for this purpose. I run a LAMP environment.
Beginning at 4am ...
3
votes
3answers
282 views
IPv6 replacement for scanning IP range
Under IPv4, I often use nmap to scan my entire IP range to identify newly-connected devices and update my documentation, track down and shut off things that don't belong on the network, etc. I even ...
1
vote
5answers
2k views
Can't get nmap to work under Windows 7 64 bit
I'm trying to install and run the nmap tool to test my server, but it keeps saying
Note: Host seems down. If it is really up, but blocking our ping probes, try -P0
and showing all the server ports ...
0
votes
2answers
269 views
how do I scan all computers in my network with nmap?
I am trying to use nmap to scan the computers on my network for conficker. I am using Windows. What do I put in the target for all computer on a given subnet?
It is running: nmap -T4 -A -v
I put ...
1
vote
3answers
1k views
how to protect from port scanning a windows server 2008
I am search to find a program, or a way to block ips that make port scan on the server.
The goal is to hide some ports like remote desktop on a different port. So some are search the port with port ...
2
votes
1answer
226 views
Are random packets normal?
About a month ago on one of my servers I started receiving random packets from IPs all over the world. So I did the smart thing and stopped putting off installing an IDS. This IDS is a ClearOS Gateway ...
2
votes
6answers
2k views
Detect computer which does port scanning
I have about 15 computers on a local network behind simple TP-LINK TL-WR340G router. Everything works fine and the router does its job.
Recently we were informed that port scanning is being performed ...
7
votes
9answers
688 views
Network vulnerability and port scanning services
I'm setting up a periodic port scan and vulnerability scan for a medium-sized network implementing a customer-facing web application. The hosts run CentOS 5.4.
I've used tools like Nmap and OpenVAS, ...
0
votes
5answers
391 views
Angry IP Scanner - no response to test
When performing a telnet command to a remote FTP port from the Windows command line, it connects as expected.
I have about 20 external hosts to connect to. I've imported the list for the Angry IP ...
