The tag has no wiki summary.

learn more… | top users | synonyms

-1
votes
1answer
30 views

Check my own servers for vulnerabilities

We are a small early stage startup with not so much money to spend. We have less than 3 servers that we want to monitor for security issues. Our website is essentially on one server having: Ubuntu ...
-2
votes
1answer
93 views

How do I know how the hacker gained access to my machine? [duplicate]

I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
1
vote
2answers
177 views

Linux/Bash: Test if my server is opened to the Internet programmatically/via CLI [closed]

RHEL 6 and Bash. It would be easy if I had a remote server to just run nmap from, or even curl/wget, but I only have access to servers on our side of the firewall. I know I can manually check ...
-2
votes
1answer
74 views

Hiding services from port scan

Upon running a port scan on my server: 22/tcp open ssh (protocol 2.0) 80/tcp open http nginx 1.4.6 (Ubuntu) 443/tcp open http nginx 1.4.6 (Ubuntu) 3000/tcp open ppp? 3001/tcp open ...
0
votes
1answer
34 views

Service pn-requester (2717) port information

I have not found big information on the internet about what does this service and for what is used. I apreciate if someone can explain to me a little. Thank you
0
votes
2answers
74 views

iptables settings open ports

ipables configuration Trying to allowing connection to a server from the outside world. Port scanners are reporting the ports are not open. Just after confirmation my iptables are correctly set. ...
0
votes
1answer
92 views

Server sending packets every 5 minutes to 3 IPs

Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling ...
3
votes
1answer
100 views

Scan SSH for offered authentication options

I'd like to scan our network (IPv4 and IPv6) for ssh and find the offered authentication options. Ultimately I'd like to end up with a parseable list[1] of hosts that contains the following info: ...
1
vote
1answer
215 views

Snort, Portscans and Scanned IP Range field

According to manual.snort.org, TCP Portscans goes from one computer to other one, but when you take a look to an tcp portscan alert in snort/snorby you can see this: In one hand: Source: ...
-5
votes
1answer
76 views

Is it possible to detect the original IP performing a port scanning to a public service through a VPN server? [closed]

I am performing a port scanning with NMAP from my laptop to some public services on Internet... I am using a VPN service, therefore my port scanning goes through VPN server and later hits the machines ...
1
vote
0answers
96 views

Why does scanlogd miss port scans?

I am running scanlogd to detect port scans. I have observed the following to generate a log message in /var/log/syslog. When I use zenmap (nmap gui) to port scan this system from another computer on ...
1
vote
1answer
2k views

What is msrpc needed for on a Windows 7 workstation

I just ran an nmap scan against our network, and many Windows 7 machines have several high ports listening with Microsoft Windows RPC. Example: Port Serv Process name 49152, msrpc [wininit.exe] ...
0
votes
1answer
530 views

How to detect my server is used as a port scanner? [duplicate]

My Web Server is running Ubuntu 12.04.2 LTS with all security updates installed. It is used as a Web Proxy server that handles incoming requests on HTTP/80 HTTPS/443 but also retrieves web content ...
1
vote
2answers
648 views

pfSense and Snort: unexpected portscan traffic on interface

I have a pfSense box acting as my public facing router and stateful firewall. There is 1 WAN interface and several LAN interfaces using private IPs behind NAT. I EXPECT to see portscans or all kinds ...
0
votes
1answer
104 views

Do an os scan with nmap only

Is it possible to do an OS detection scan with nmap without scanning a port? I really need only OS detection and try to reduce the amount of traffic as much as possible. By the way what is the most ...
1
vote
2answers
1k views

Port Scanning Temporary Block on Linux Centos

I am running a VPS server (Linux CentOS) to provide web hosting for my clients. Yesterday, one of my clients got blocked out by the LFD firewall on my server: I got a server admin email notification ...
0
votes
1answer
263 views

Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role

Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this: The message repeats every second and the port number is increased by one the range ...
0
votes
1answer
480 views

Frequent UDP_IN Blocked for Port Scanning

I run a blog self-hosted with Wordpress. I'm getting frequent email notifications from LFD regarding UDP_IN blocks. I usually get 10+ emails daily about it. The email looks like following: Time: ...
0
votes
2answers
302 views

nmap scan only state of port

Is it possible with nmap to check only the state of a port whether- open, closed or filtered and NOT the services behind it? The aim is to speed up scan results. Since UDP scan is also involved it is ...
0
votes
0answers
312 views

Cannot enable shunning of IP scan attackers - error message on asa 5520

I've got the scanning threat detection turned on, in my Cisco ASA 5520, but someone turned off the option for "shun hosts detected by scanning threat". Now, when I try to enable it through the ASDM ...
2
votes
2answers
778 views

Weird Port scanning results using nmap

I was scanning one of my friends servers using nmap and got these port details. PORT STATE SERVICE 22/tcp open ssh 42/tcp filtered nameserver 80/tcp open http 111/tcp open ...
1
vote
2answers
319 views

How to prevent port scanning by VPN users on a CentOS VPN gateway

I'm using CentOS as a VPN gateway. Users connected to my server have access to the internet. The problem is that some of the users' computers are infected with some kind of worm, and as soon as they ...
0
votes
1answer
910 views

Symantec Endpoint Protection “portscan attack” false alarms?

On two Windows 7 machines in my LAN I have Symantec Endpoint Protection 12.1 installed. Things work fine, but several time per day I get to see the following warning: I had a thorough look at the ...
0
votes
1answer
608 views

identity and rectify port scanning activities on CentOS [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux (CentOS 5.x) machine seem to have been attacked. Port scanning activities were traced to it. However, the ports (to be) ...
43
votes
11answers
5k views

Does changing default port number actually increase security?

I have seen advice saying you should use different port numbers for private applications (e.g. intranet, private database, anything that no outsider will use). I am not entirely convinced that can ...
1
vote
1answer
142 views

Detecting a host doing a port sweep across multiple interfaces/networks

I'm trying to set up a honey-pot like machine that would detect port sweeps from multiple networks with multiple interfaces. As an illustration, if I could set up a box with eth1, eth2 and eth3. ...
1
vote
1answer
173 views

Nmap reporting incorrect results from an idle scan

I have a VPS that I was scanning to make sure everything is in check. A regular SYN scan reports that ports 25 and 80 are open (which they should be). When I run an idle scan however, I get back that ...
0
votes
1answer
761 views

All-day Port scanning “victim” - How worried should I be? (CentOS)

In addition to my day job as a technical support specialist, I operate a shared web hosting environment and run a number of servers for this purpose. I run a LAMP environment. Beginning at 4am ...
3
votes
3answers
478 views

IPv6 replacement for scanning IP range

Under IPv4, I often use nmap to scan my entire IP range to identify newly-connected devices and update my documentation, track down and shut off things that don't belong on the network, etc. I even ...
1
vote
5answers
3k views

Can't get nmap to work under Windows 7 64 bit

I'm trying to install and run the nmap tool to test my server, but it keeps saying Note: Host seems down. If it is really up, but blocking our ping probes, try -P0 and showing all the server ports ...
0
votes
2answers
323 views

how do I scan all computers in my network with nmap?

I am trying to use nmap to scan the computers on my network for conficker. I am using Windows. What do I put in the target for all computer on a given subnet? It is running: nmap -T4 -A -v I put ...
1
vote
3answers
2k views

how to protect from port scanning a windows server 2008

I am search to find a program, or a way to block ips that make port scan on the server. The goal is to hide some ports like remote desktop on a different port. So some are search the port with port ...
2
votes
1answer
240 views

Are random packets normal?

About a month ago on one of my servers I started receiving random packets from IPs all over the world. So I did the smart thing and stopped putting off installing an IDS. This IDS is a ClearOS Gateway ...
2
votes
6answers
3k views

Detect computer which does port scanning

I have about 15 computers on a local network behind simple TP-LINK TL-WR340G router. Everything works fine and the router does its job. Recently we were informed that port scanning is being performed ...
7
votes
9answers
758 views

Network vulnerability and port scanning services

I'm setting up a periodic port scan and vulnerability scan for a medium-sized network implementing a customer-facing web application. The hosts run CentOS 5.4. I've used tools like Nmap and OpenVAS, ...
0
votes
5answers
555 views

Angry IP Scanner - no response to test

When performing a telnet command to a remote FTP port from the Windows command line, it connects as expected. I have about 20 external hosts to connect to. I've imported the list for the Angry IP ...