Re: [SLUG] scans

From: Robert Foxworth (rfoxwor1@tampabay.rr.com)
Date: Fri Dec 13 2002 - 09:11:15 EST


Oh no, didn't waste my time at all, I often keep an eye on the network
here to see what is floating in. I have a couple of little machines set
aside for monitoring which are usually on.

A lot of your IPs are from Asia-Pacific BTW.

Actually it shouldn't matter if your IP was dynamic or static, unless
hackers take the time to identify the netblocks set aside for static
and target them differently. I don't believe that happens much if at all.
But to tell, someone would have to systematically monitor both types
of address for a while, simultaneously, and see what develops and
gets logged. Maybe easier to check Dshield.

You might want to block 445 as well as 135:139.

0xb0bf

> leftover traffic. I looked up some of the "non-137" ports and they were
> the typical online gamer ports along with IM and ICQ.
>
> Thanks for the packet capture, Bob. Hope I didn't waste your time over
> nothing. Tomorrow's project is to make sure the Micro$lop traffic
> doesn't get logged anymore. :)
>
> Thanks guys!
>
> Jeff
>



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 19:13:25 EDT