Port scan activty

Port scan activty

Secure Home | Search | About
 Networking Firewalls    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Port scan activty Richard Steinfeld 01-11-2006
Posted by Richard Steinfeld on January 11, 2006, 2:35 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I've been using Sygate Personal Firewall(free version) for at least two
years. Sygate gives me frequent port scan alerts that are always the same:

There were thirteen of these scans within the last week. Most days,
there are 2-3 scan attempts per day. My machine is only connected via
DSL when it's on; when I'm not using it, it is often off. Thus, there
may have been more scan attempts than what's been recorded.

All attempts originate from one "Remote MAC" and four separate hosts.
Every event scans four ports, seemingly at random, except that there's
some clustering around certain port numbers. Most scans include port
1030. The second most common port scanned is 1033. The remainder are
mostly random numbers close to 1030. There is often one scanned port in
the 4000 range.

Can someone tell me what this activity is?

Thanks.

Richard

Posted by Jeff B on January 11, 2006, 1:04 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Richard Steinfeld wrote:
> I've been using Sygate Personal Firewall(free version) for at least two
> years. Sygate gives me frequent port scan alerts that are always the same:
>
> There were thirteen of these scans within the last week. Most days,
> there are 2-3 scan attempts per day. My machine is only connected via
> DSL when it's on; when I'm not using it, it is often off. Thus, there
> may have been more scan attempts than what's been recorded.
>
> All attempts originate from one "Remote MAC" and four separate hosts.
> Every event scans four ports, seemingly at random, except that there's
> some clustering around certain port numbers. Most scans include port
> 1030. The second most common port scanned is 1033. The remainder are
> mostly random numbers close to 1030. There is often one scanned port in
> the 4000 range.
>
> Can someone tell me what this activity is?
>
> Thanks.
>
> Richard

Google 'port xxx' works very well. In case, see
http://grc.com/port_1030.htm


--
---
Jeff B (remove the No-Spam to reply)

Similar ThreadsPosted
Port scan by DNS normal? March 19, 2007, 4:16 pm
Sonicwall "possible port scan" Help! May 21, 2007, 10:31 am
UPD Port Scan from DNS Server Happening, What's Up? January 15, 2006, 2:30 pm
Frequnt port scan attacks October 15, 2007, 9:42 am
Port scan from grc.com fails 1st time passes the 2nd? March 11, 2005, 3:46 pm
TCP FIN scan April 14, 2006, 3:08 am
Attempt to scan ports March 12, 2006, 7:59 pm
using nmap to scan firewall September 2, 2007, 12:56 pm
Norton NIS autoblocks cable modem DNS Scan March 7, 2007, 4:03 pm
ZoneAlarm Pro 6.5.714 won't install with McAfee Virus Scan installed June 17, 2006, 9:14 pm

The site map in XML format XML site map

Contact Us | Privacy Policy